Display IP address from packets

Question

How can I display IP Address from the packets.

I am able to display ports and protocols but not the IP addresses from a pcap file .

I am using jnetpcap . Any help ?

Answer 1

The jnetpcap team states " Although these are native C library tutorials, you will find that the procedures and sequences of calls are nearly identical. If you know the C and java languages, you shouldn't have much trouble translating these tutorials to java and jNetPcap API. " That being said, take a look at this very in-depth tutorial the jnetpcap team recommends on their website.

Take a look near the end, under The actual sniffing , the tutorial lays out the packet contents in memory and tells you exactly where to look to find the IP header.

Other solutions:

If you're able to get a pcap file, you should be able to use the native DatagramPacket class for your needs. DatagramPacket has a method called getSocketAddress() that will get you the IP address and the port number.

Answer 2

PcapPacketHandler<String> jpacketHandler = new PcapPacketHandler<String>() {  

        final Tcp tcp=new Tcp();

    final Ip4 ip = new Ip4(); 

                public void nextPacket(PcapPacket packet, String user) {  


                    final Tcp tcp=new Tcp();
                        if(packet.hasHeader(tcp)){
                        if(packet.hasHeader(ip)){

                        packet.getHeader(tcp);
                        System.out.printf("Received packet at %s caplen=%-4d len=%-4d %s %s\n",  
                        new Date(packet.getCaptureHeader().timestampInMillis()),   
                        packet.getCaptureHeader().caplen(),  // Length actually captured  
                        packet.getCaptureHeader().wirelen(), // Original length   
                        user,FormatUtils.ip(ip.source())                              // User supplied object  
                        );  
                        //JBuffer buffer = packet;
                        //int size=packet.size();
                        byte[] arr=packet.getByteArray(0, packet.size());

                    }}}

            };  

Answer 3

wireshark is able to display (and capture) the data. I will look into jnetpcap.

Edit: I have looked up the tutorial ( http://jnetpcap.com/tutorial/usage ). See the lines 72 (creating the return object) and 108-112 (filling and reading the return object).

Answer 4

I was able to get the IP address and port numbers of both source and destination endpoints from PCAP using the below Github example:

https://github.com/arisath/Pcap-dissection/blob/master/PcapDissector.java