ipgrab
Mike Borella
mike@borella.netNOPSAM
COPYRIGHT
Copyright (C) 1997-99 Mike Borella
Redistribution and use in source and binary forms are permitted provided that this paragraph is duplicated in all such forms and in any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by Mike Borella. The name of the Author may not be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
Some of this code has been taken from tcpdump, which was developed by the Network Research Group at Lawrence Berkeley National Lab, and is copyrighted by the University of California Regents.
DESCRIPTION
This program reads and parses packets from the link layer through the transport layer, dumping explicit header information along the way. It is a lot like tcpdump from LBL except that I've made an effort to dump every relevant header field possible. The overall structure of the code is loosely based on tcpdump and I've lifted a few modules from the tcpdump distribution when necessary, rather than re-inventing the wheel. In particular, the address conversion hashing routines are pretty much lifted verbatim, as well as the TCP options section.
I expect that this code can be used for detailed packet level debugging of existing or new protocols. Also, I imagine that it could be a useful teaching and instruction tool for TCP/IP or security courses. I've made an effort to make the code readable, sometimes even at the expense of efficiency, so that one can use it to learn about the pcap library calls and the header field data structures.
Would you like to see new features and protocols supported? Do you have a proprietary protocol that you'd like to test? Two ways to make it happen: (1) write a module yourself - if you send me a copy I'll merge it into my source and acknowledge you as author, (2) ask me to write it - send me email for details.
INSTALLATION
You must have the pcap library (libpcap) version 0.3 or greater installed. In particular, the pcap.h and net/bpf.h files must be in an appropriate include directory (just grabbing a pre-compiled libpcap.so won't cut it). Download pcap from http://www-nrg.ee.lbl.gov.
Run the configure script to create a Makefile, then type 'make'. If you need to install any other libraries or headers, configure should tell you.
It should compile cleanly on Linux 2.0.x and 2.2.x, FreeBSD 3.2, and Solaris 2.7. Unfortunately the Solaris port will crash on IPX RIP packets. I hope to fix this soon.
OPERATION
See man page for details.
THANKS
Marty Roesch fixed some of the timestamping, and provided the code for payload output. Jorgen Pehrson provided the buffered output option. Stuart Stock added a lot of fixes to ISAKMP. Cullen Jennings contributed the MGCP parser.
Lots of other people suggested things that eventually made their way into the code, in one form or another.
PROTOCOLS KNOWN
Fully Supported:
- IP
- TCP
- UDP
- ARP
- Ethernet
- SLIP
- Raw IP
- Loopback
- ESP
- AH
- IPX
Partially Supported or Untested:
- IPX/RIP
- SPX
- DNS
- DHCP
- L2TP
- RIP
- SIP
- SDP
- ISAKMP
- RSIP
- MGCP
- SNMP v1, v2c
Currently Broken:
- RTP
TO DO
- Config file for protocols that use varying ports (RTP, etc.)
- IPv6 and IGMP support.
- PPP, NTP, and NetBios support.
- PPTP