raw_tcpsniff.c

// Sniffer raw socket en Linux — captura TODO el tráfico de la interfaz por
// defecto y muestra cabeceras Ethernet/IP/TCP.
//
// Requiere CAP_NET_RAW o root: sudo ./raw_tcpsniff
//
// Para defenderse de capturar cifrado, no hace nada: solo muestra metadatos.
#include "../0x260/0x265_hacking.h"
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ether.h>

#define BUF 65536

void print_eth(struct ether_header *eh) {
    printf("ETH  %02x:%02x:%02x:%02x:%02x:%02x -> %02x:%02x:%02x:%02x:%02x:%02x  type=0x%04x\n",
           eh->ether_shost[0], eh->ether_shost[1], eh->ether_shost[2],
           eh->ether_shost[3], eh->ether_shost[4], eh->ether_shost[5],
           eh->ether_dhost[0], eh->ether_dhost[1], eh->ether_dhost[2],
           eh->ether_dhost[3], eh->ether_dhost[4], eh->ether_dhost[5],
           ntohs(eh->ether_type));
}

void print_ip(struct iphdr *ip) {
    char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
    inet_ntop(AF_INET, &ip->saddr, src, sizeof src);
    inet_ntop(AF_INET, &ip->daddr, dst, sizeof dst);
    printf("  IP  %s -> %s  proto=%d ttl=%d len=%d\n",
           src, dst, ip->protocol, ip->ttl, ntohs(ip->tot_len));
}

void print_tcp(struct tcphdr *t) {
    printf("    TCP %d -> %d  seq=%u ack=%u  flags=%c%c%c%c%c%c\n",
           ntohs(t->source), ntohs(t->dest),
           ntohl(t->seq), ntohl(t->ack_seq),
           t->urg ? 'U' : '.', t->ack ? 'A' : '.',
           t->psh ? 'P' : '.', t->rst ? 'R' : '.',
           t->syn ? 'S' : '.', t->fin ? 'F' : '.');
}

int main(void) {
    int sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (sock < 0) { perror("socket (necesitas root)"); return 1; }

    unsigned char buf[BUF];
    while (1) {
        ssize_t n = recv(sock, buf, sizeof buf, 0);
        if (n < (ssize_t) sizeof(struct ether_header)) continue;

        struct ether_header *eh = (struct ether_header *) buf;
        print_eth(eh);
        if (ntohs(eh->ether_type) != ETHERTYPE_IP) continue;

        struct iphdr *ip = (struct iphdr *) (buf + sizeof(*eh));
        print_ip(ip);

        if (ip->protocol == IPPROTO_TCP) {
            struct tcphdr *t = (struct tcphdr *) ((unsigned char *) ip + ip->ihl * 4);
            print_tcp(t);
        }
        printf("\n");
    }
    return 0;
}