tutorial/linux/arpmonitor.c

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <errno.h>
#include <sys/types.h>
#include <asm/types.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/route.h>
#include <sys/stat.h>
#include <dirent.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
//#include <libconfig.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <syslog.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>

#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/sockios.h>

#include <stdbool.h>

#define BIT_IP(x)    ((unsigned char*)&(x))
#define STR_IP(x)    BIT_IP(x)[0], BIT_IP(x)[1], BIT_IP(x)[2], BIT_IP(x)[3]
#define STR_IPH(x)    BIT_IP(x)[3], BIT_IP(x)[2], BIT_IP(x)[1], BIT_IP(x)[0]
#define FMT_IP        "%d.%d.%d.%d"

#ifndef NDA_RTA
#define NDA_RTA(r) \
    ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct ndmsg))))
#endif
#ifndef NDA_PAYLOAD
#define NDA_PAYLOAD(n)    NLMSG_PAYLOAD(n,sizeof(struct ndmsg))
#endif

void arp_parse_rattr(struct rtattr **tb, int max, struct rtattr *rta, int len)
{
    memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
    while (RTA_OK(rta, len)) {
        if ((rta->rta_type <= max) && (!tb[rta->rta_type]))
            tb[rta->rta_type] = rta;
        rta = RTA_NEXT(rta,len);
    }
    if (len)
        fprintf(stderr, "!!!Deficit %d, rta_len=%d\n", len, rta->rta_len);
    
    return;
}

const char *addr_to_mac(unsigned char *addr, int alen, char *buf, ssize_t blen)
{
    int i;
    int l;
    
    l = 0;
    for (i = 0; i < alen; i++) {
        if (i==0) {
            snprintf(buf+l, blen, "%02x", addr[i]);
            blen -= 2;
            l += 2;
        } else {
            snprintf(buf+l, blen, ":%02x", addr[i]);
            blen -= 3;
            l += 3;
        }
    }
    return buf;
}

static void read_netlink_message(int fd)
{
    char buff[128 * 1024] = {0};
    char *buf[1024] = {0};
    struct nlmsghdr *nh;
    struct ndmsg *ndmsg;
    int read_size;
    int len = 0;    
    struct rtattr *tb[NDA_MAX + 1];
    
    read_size = read(fd, buff, sizeof(buff));
    if (read_size < 0) {
        return;
    }                    
    
    for (nh = (struct nlmsghdr*)buff; NLMSG_OK(nh, read_size); nh = NLMSG_NEXT(nh, read_size)) 
	{
        switch (nh->nlmsg_type) 
		{
        case RTM_NEWNEIGH:
            ndmsg = NLMSG_DATA(nh);
            if (ndmsg->ndm_family == AF_INET) 
			{
                printf("add new arp cache ");
                len = nh->nlmsg_len - NLMSG_SPACE(sizeof(struct ndmsg));
                arp_parse_rattr(tb, NDA_MAX, NDA_RTA(ndmsg), len);
				uint32_t ipaddr = htonl(*((uint32_t *)RTA_DATA(tb[NDA_DST])));
                if (tb[NDA_DST] && tb[NDA_LLADDR])
				{
                    printf("ip: %d.%d.%d.%d ", (ipaddr >> 24) & 0xFF, (ipaddr >> 16) & 0xFF, (ipaddr >> 8) & 0xFF, ipaddr & 0xFF);
					unsigned char *macaddr = RTA_DATA(tb[NDA_LLADDR]);
					int maclen = RTA_PAYLOAD(tb[NDA_LLADDR]);
					
					printf("mac: %x:%x:%x:%x:%x:%x\n", macaddr[0], macaddr[1], macaddr[2], macaddr[3], macaddr[4], macaddr[5]);
                }
            }
            break;
        default:
            break;
        }
    }
    
    return;    
}

int main(void)
{
    int fd;
    struct sockaddr_nl sa;
    fd_set rd_set;
    int ret;
    
    fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
    
    bzero(&sa, sizeof(sa));
    
    sa.nl_family = AF_NETLINK;
    sa.nl_groups = RTM_NEWNEIGH | RTM_DELNEIGH;
    
    if ((bind(fd, (struct sockaddr *)&sa, sizeof(sa))) != 0) {
        perror("bind");
        return -1;
    }
    
    while (1) {
        FD_ZERO(&rd_set);
        FD_SET(fd, &rd_set);
        ret = select(fd + 1, &rd_set, NULL, NULL, NULL);
        if (ret < 0) {
            printf("select error\n");
            break;
        } else if (ret > 0) {
            if (FD_ISSET(fd, &rd_set)) {
                read_netlink_message(fd);
            }
        }
    }
    
    close(fd);
    return 0;
}