he program must be named \"TracerouteAnalysis.java\", and needs to take the file
ID: 3856889 • Letter: H
Question
he program must be named "TracerouteAnalysis.java", and needs to take the file name of the tcpdump trace as the first argument. For example, the program needs to run as
$ javac TracerouteAnalysis.java
$ java TracerouteAnalysis Project_1-example_traceroute_TCP_trace.txt
and the results of the analysis must be written on standard output (basically, on screen).
NOTE: project submissions that do not follow the guidelines will be discarded wihtout consideration (i.e., 0 points).
Project Description: In this project, you are required to write a program that takes in input a textual tcpdump trace of traffic generated by Traceroute and computes the time between a TCP packet sent by the client and the related ICMP "Time exceeded in-transit" message.
As an example, consider the two packet logs reported below:
1291654312.963163 IP (tos 0x0, ttl 1, id 9067, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.47212 > 137.138.144.168.80: S, cksum 0xc4d6 (correct), 1135826272:1135826272(0) win 5840 <mss 1460,sackOK,timestamp 2152510109 0,nop,wscale 2>
1291654312.963644 IP (tos 0xc0, ttl 255, id 2503, offset 0, flags [none], proto ICMP (1), length 56) 128.192.76.129 > 128.192.76.177: ICMP time exceeded in-transit, length 36
IP (tos 0x0, ttl 1, id 9067, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.47212 > 137.138.144.168.80: tcp 40 [bad hdr length 0 - too short, < 20]
as we can see from the highlighted fields, the two packets are related to each other.
The fields you should check to match a sent TCP packet with the related ICMP response are: id 9067, TCP, 128.192.76.177.47212 > 137.138.144.168.80
Notice that these fields are replicated in the body of the ICMP message (in practice the IP ID field should be sufficient to correctly correlate the two packets).
From the two packets above, the output should be:
TTL 1
128.192.76.129
0.481 ms
where 128.192.76.129 is the IP addresses of the router that generated the ICMP response, and 0.481 ms is computed as (1291654312.963644 - 1291654312.963163) * 1000 and rounding to obtain only three digits after the dot.
As another example the output related to the following packets
1291654312.963267 IP (tos 0x0, ttl 3, id 9075, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.56812 > 137.138.144.168.80: S, cksum 0x5834 (correct), 2778675862:2778675862(0) win 5840 <mss 1460,sackOK,timestamp 2152510109 0,nop,wscale 2>
1291654312.963655 IP (tos 0x0, ttl 62, id 47385, offset 0, flags [none], proto ICMP (1), length 56) 128.192.254.49 > 128.192.76.177: ICMP time exceeded in-transit, length 36
IP (tos 0x0, ttl 1, id 9075, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.56812 > 137.138.144.168.80: tcp 40 [bad hdr length 0 - too short, < 20]
would be
TTL 3
128.192.254.49
0.388 ms
Consecutive TCP-ICMP packet pairs related to the same ICMP source IP should be listed without repeating the TTL value and IP string. For example, if there are 3 consecutive TCP-ICMP packet pairs related to TTL=3 and with ICMP packets originating from 128.192.254.49, you should list them as
TTL 3
128.192.254.49
0.388 ms
0.401 ms
0.398 ms
Explanation / Answer
#include <pcap.h>
...
pcap_t *handle; /* Session handle */
char dev[] = "rl0"; /* Device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter expression */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* The netmask of our sniffing device */
bpf_u_int32 net; /* The IP of our sniffing device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Can't get netmask for device %s ", dev);
net = 0;
mask = 0;
}
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s ", dev, errbuf);
return(2);
}
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
#include <pcap.h>
#include <stdio.h>
int main(int argc, char *argv[])
{
pcap_t *handle; /* Session handle */
char *dev; /* The device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* Our netmask */
bpf_u_int32 net; /* Our IP */
struct pcap_pkthdr header; /* The header that pcap gives us */
const u_char *packet; /* The actual packet */
/* Define the device */
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s ", errbuf);
return(2);
}
/* Find the properties for the device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Couldn't get netmask for device %s: %s ", dev, errbuf);
net = 0;
mask = 0;
}
/* Open the session in promiscuous mode */
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s ", dev, errbuf);
return(2);
}
/* Compile and apply the filter */
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
/* Grab a packet */
packet = pcap_next(handle, &header);
/* Print its length */
printf("Jacked a packet with length of [%d] ", header.len);
/* And close the session */
pcap_close(handle);
return(0);
}
struct sniff_ethernet {
u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
u_short ether_type; /* IP? ARP? RARP? etc */
};
/* IP header */
struct sniff_ip {
u_char ip_vhl; /* version << 4 | header length >> 2 */
u_char ip_tos; /* type of service */
u_short ip_len; /* total length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
/* TCP header */
typedef u_int tcp_seq;
struct sniff_tcp {
u_short th_sport; /* source port */
u_short th_dport; /* destination port */
tcp_seq th_seq; /* sequence number */
tcp_seq th_ack; /* acknowledgement number */
u_char th_offx2; /* data offset, rsvd */
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
u_short th_win; /* window */
u_short th_sum; /* checksum */
u_short th_urp; /* urgent pointer */
};
void another_callback(u_char *arg, const struct pcap_pkthdr* pkthdr,
const u_char* packet)
{
int i=0;
static int count=0;
printf("Packet Count: %d ", ++count); /* Number of Packets */
printf("Recieved Packet Size: %d ", pkthdr->len); /* Length of header */
printf("Payload: "); /* And now the data */
for(i=0;i<pkthdr->len;i++) {
if(isprint(packet[i])) /* Check if the packet data is printable */
printf("%c ",packet[i]); /* Print it */
else
printf(" . ",packet[i]); /* If not print a . */
if((i%16==0 && i!=0) || i==pkthdr->len-1)
printf(" ");
}
}
#include <pcap.h>
...
pcap_t *handle; /* Session handle */
char dev[] = "rl0"; /* Device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter expression */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* The netmask of our sniffing device */
bpf_u_int32 net; /* The IP of our sniffing device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Can't get netmask for device %s ", dev);
net = 0;
mask = 0;
}
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s ", dev, errbuf);
return(2);
}
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
#include <pcap.h>
#include <stdio.h>
int main(int argc, char *argv[])
{
pcap_t *handle; /* Session handle */
char *dev; /* The device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* Our netmask */
bpf_u_int32 net; /* Our IP */
struct pcap_pkthdr header; /* The header that pcap gives us */
const u_char *packet; /* The actual packet */
/* Define the device */
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s ", errbuf);
return(2);
}
/* Find the properties for the device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Couldn't get netmask for device %s: %s ", dev, errbuf);
net = 0;
mask = 0;
}
/* Open the session in promiscuous mode */
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s ", dev, errbuf);
return(2);
}
/* Compile and apply the filter */
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s ", filter_exp, pcap_geterr(handle));
return(2);
}
/* Grab a packet */
packet = pcap_next(handle, &header);
/* Print its length */
printf("Jacked a packet with length of [%d] ", header.len);
/* And close the session */
pcap_close(handle);
return(0);
}
struct sniff_ethernet {
u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
u_short ether_type; /* IP? ARP? RARP? etc */
};
/* IP header */
struct sniff_ip {
u_char ip_vhl; /* version << 4 | header length >> 2 */
u_char ip_tos; /* type of service */
u_short ip_len; /* total length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
/* TCP header */
typedef u_int tcp_seq;
struct sniff_tcp {
u_short th_sport; /* source port */
u_short th_dport; /* destination port */
tcp_seq th_seq; /* sequence number */
tcp_seq th_ack; /* acknowledgement number */
u_char th_offx2; /* data offset, rsvd */
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
u_short th_win; /* window */
u_short th_sum; /* checksum */
u_short th_urp; /* urgent pointer */
};
void another_callback(u_char *arg, const struct pcap_pkthdr* pkthdr,
const u_char* packet)
{
int i=0;
static int count=0;
printf("Packet Count: %d ", ++count); /* Number of Packets */
printf("Recieved Packet Size: %d ", pkthdr->len); /* Length of header */
printf("Payload: "); /* And now the data */
for(i=0;i<pkthdr->len;i++) {
if(isprint(packet[i])) /* Check if the packet data is printable */
printf("%c ",packet[i]); /* Print it */
else
printf(" . ",packet[i]); /* If not print a . */
if((i%16==0 && i!=0) || i==pkthdr->len-1)
printf(" ");
}
}
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.