How can I parse an ethernet packet using libpcap?

Question

I'm using libpcap in C++ for reading packets from pcap files, e.g.:

rc = pcap_next_ex((pcap_t*)handle, &header, (const unsigned char**)packet);

I would like to parse the packets header (without the payload).

For example, how can I parse a given packet in order to extract its source and destintation ip addresses?

thanks

If you want to use C++ why not using a library which wraps libpcap and provides built-in protocol parsers? I can recommend PcapPlusPlus which I'm using, please see this tutorial to learn how to parse packets using this library. — John

Ioannis Pappas Ioannis Pappas · Accepted Answer · 2011-06-24T14:56:13

Checkout the code sample for libpcap http://www.tcpdump.org/pcap.html

In the got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet); function you have a pointer *packet that points to the start of the packet. For parsing the ethernet headers you just need to use the corresponding pointer

ethernet = (struct sniff_ethernet*)(packet);

For IP layer

ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);

If you want to parse other protocols, you just need to define your own structures. If you want (or do not want) to parse the payload then you can (or not) define a pointer to the start of the payload.

How can I parse an ethernet packet using libpcap?

2 Answers