Содержание статьи

• Sniffer
• Стек протоколов TCP/IP
  • Ethernet
  • Internet Protocol
  • Transmission Control Protocol
  • User Datagram Protocol
• Анализатор
• Заключение

Sniffer

#ifndef __LINUX_SNIFFER_SHIFFER_H__
#define __LINUX_SNIFFER_SHIFFER_H__


#include <set>
#include <string.h>
#include <stdexcept>
#include "Analyzer.h"


namespace LinuxSniffer {

class SnifferError :
    public std::runtime_error
{
public:
    SnifferError(const std::string & message) throw() :
        std::runtime_error(message)
    {
    }

    virtual ~SnifferError() throw()
    {
    }
}; // class SnifferError


class Sniffer
{
public:
    explicit Sniffer(const std::string & device_name, bool sniff_all = false)
        throw(SnifferError);
    virtual ~Sniffer();
    bool addAnalyzer(Analyzer * analyzer);
    bool removeAnalyzer(Analyzer * analyzer);
    void start() throw(SnifferError);
    void stop();

private:
    void deinit();
    void makeSocket() throw(SnifferError);
    void bindSocketToDevice() throw(SnifferError);
    void setPromiscuousMode() throw(SnifferError);
    void unsetPromiscuousMode();
    void runAnalyzers(const unsigned char * frame, size_t frame_size);

private:
    Sniffer(const Sniffer &);
    Sniffer & operator = (const Sniffer &);

private:
    const std::string m_device;
    const bool m_sniff_all;
    std::set<Analyzer *> m_analyzers;
    int m_socket;
    bool m_is_promiscuouse_mode_set;
    bool m_is_stopping;
    unsigned char * mp_frame_buffer;
    static const size_t m_frame_buffer_size = 65536;
}; // class Sniffer


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_SHIFFER_H__

class Analyzer
{
public:
    virtual ~Analyzer() { }
    virtual void analyze(const uint8_t * frame, size_t frame_size) = 0;
}; // class Analyzer

#include <errno.h>
#include <netpacket/packet.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <arpa/inet.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/sockios.h>
#include "Sniffer.h"


using namespace LinuxSniffer;


Sniffer::Sniffer(const std::string & device_name, bool sniff_all)
    throw(SnifferError) :
    m_device(device_name),
    m_sniff_all(sniff_all),
    m_is_promiscuouse_mode_set(false),
    m_is_stopping(false),
    mp_frame_buffer(0)
{
    makeSocket();
    mp_frame_buffer = new unsigned char[m_frame_buffer_size];
}

Sniffer::~Sniffer()
{
    deinit();
}

void Sniffer::deinit()
{
    ::close(m_socket);
    unsetPromiscuousMode();
    delete [] mp_frame_buffer;
}

bool Sniffer::addAnalyzer(Analyzer * analyzer)
{
    return m_analyzers.insert(analyzer).second;
}

bool Sniffer::removeAnalyzer(Analyzer * analyzer)
{
    return m_analyzers.erase(analyzer) > 0;
}

void Sniffer::makeSocket()
    throw(SnifferError)
{
    m_socket = ::socket(AF_PACKET, SOCK_RAW, ::htons(ETH_P_ALL));
    if(-1 == m_socket)
        throw SnifferError(::strerror(errno));
    try
    {
        bindSocketToDevice();
        if(m_sniff_all)
            setPromiscuousMode();
    }
    catch(...)
    {
        deinit();
        throw;
    }
}

void Sniffer::bindSocketToDevice()
    throw(SnifferError)
{
    const size_t device_name_len = m_device.length() + 1;
    char * device = new char[device_name_len];
    ::strcpy(device, m_device.c_str());
    device[m_device.length()] = '';
    int setopt_result = ::setsockopt(m_socket, SOL_SOCKET,
        SO_BINDTODEVICE, device, device_name_len);
    delete [] device;
    if(-1 == setopt_result)
        throw SnifferError(::strerror(errno));
}

void Sniffer::setPromiscuousMode() throw(SnifferError)
{
    ifreq iface;
    ::strcpy(iface.ifr_name, m_device.c_str());
    if(::ioctl(m_socket, SIOCGIFFLAGS, &iface) < 0)
        throw SnifferError(::strerror(errno));
    iface.ifr_flags |= IFF_PROMISC;
    if(::ioctl(m_socket, SIOCSIFFLAGS, &iface) < 0)
        throw SnifferError(::strerror(errno));
    m_is_promiscuouse_mode_set = true;
}

void Sniffer::unsetPromiscuousMode()
{
    if(!m_is_promiscuouse_mode_set)
        return;
    ifreq iface;
    ::strcpy(iface.ifr_name, m_device.c_str());
    if(::ioctl(m_socket, SIOCGIFFLAGS, &iface) >= 0)
    {
        iface.ifr_flags &= ~IFF_PROMISC;
        if(::ioctl(m_socket, SIOCSIFFLAGS, &iface) >= 0)
            m_is_promiscuouse_mode_set = false;
    }
}

void Sniffer::start() throw(SnifferError)
{
    while(!m_is_stopping)
    {
        ssize_t length = ::recvfrom(m_socket, mp_frame_buffer,
            m_frame_buffer_size, 0, 0, 0);
        if(-1 == length)
            throw SnifferError(::strerror(errno));
        runAnalyzers(mp_frame_buffer, length);
    }
}

void Sniffer::runAnalyzers(const unsigned char * frame, size_t frame_size)
{
    for(std::set<Analyzer *>::iterator it = m_analyzers.begin();
        m_analyzers.end() != it; ++it)
    {
        Analyzer * analyzer = *it;
        if(0 != analyzer)
            analyzer->analyze(frame, frame_size);
    }
}

void Sniffer::stop()
{
    m_is_stopping = true;
}

m_socket = ::socket(AF_PACKET, SOCK_RAW, ::htons(ETH_P_ALL));

SOCK_PACKET
       Устарело и не должно использоваться в новых программах; см.  packet(7).

::setsockopt(m_socket, SOL_SOCKET, SO_BINDTODEVICE, device, device_name_len); 

::ioctl(m_socket, SIOCGIFFLAGS, &iface)

iface.ifr_flags |= IFF_PROMISC;

::ioctl(m_socket, SIOCSIFFLAGS, &iface)

ssize_t length = ::recvfrom(m_socket, mp_frame_buffer, m_frame_buffer_size, 0, 0, 0);

Стек протоколов TCP/IP

Ethernet

#ifndef __LINUX_SNIFFER_PROTOCOL_FRAME_H__
#define __LINUX_SNIFFER_PROTOCOL_FRAME_H__

#include <string>
#include <sys/types.h>
#include <stdint.h>

namespace LinuxSniffer {


class ProtocolFrame
{
public:
    ProtocolFrame(const std::string & protocol_name) :
        m_protocol_name(protocol_name),
        m_data_offset(0)
    {
    }

    virtual ~ProtocolFrame()
    {
    }

    const std::string & getName() const
    {
        return m_protocol_name;
    }

    virtual bool init(const uint8_t * buffer, size_t buffer_size) = 0;

    size_t getDataOffset() const
    {
        return m_data_offset;
    }

protected:
    void setDataOffset(size_t offset)
    {
        m_data_offset = offset;
    }

private:
    const std::string m_protocol_name;
    size_t m_data_offset;
}; // class ProtocolFrame


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_PROTOCOL_FRAME_H__

#ifndef __LINUX_SNIFFER_ETHERNET_FRAME_V2_H__
#define __LINUX_SNIFFER_ETHERNET_FRAME_V2_H__

#include <cstring>
#include "ProtocolFrame.h"
#include "MacAddress.h"

namespace LinuxSniffer {

class EthernetFrameV2 :
    public ProtocolFrame
{
public:
    EthernetFrameV2() :
        ProtocolFrame("Ethernet Version 2")
    {
    }

    virtual ~EthernetFrameV2()
    {
    }

    virtual bool init(const uint8_t * buffer, size_t buffer_size);

    const MacAddress & getSourceMacAddress() const
    {
        return m_src_mac_addr;
    }

    const MacAddress & getDestinationMacAddress() const
    {
        return m_dest_mac_addr;
    }

    static const uint8_t (& getEthernetType())[2]
    {
        static bool is_init = false;
        static uint8_t type[2];
        if(!is_init)
        {
             ::memcpy(type, "x08x00", 2);
             is_init = true;
        }
        return type;
    }

private:
    MacAddress m_src_mac_addr;
    MacAddress m_dest_mac_addr;
}; // class EthernetFrameV2

} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_ETHERNET_FRAME_V2_H__

#ifndef __LINUX_SNIFFER_MAC_ADDRESS_H__
#define __LINUX_SNIFFER_MAC_ADDRESS_H__

#include <stdint.h>
#include <string>
#include <cstdio>

namespace LinuxSniffer {


class MacAddress
{
public:
    MacAddress() :
        b0(0),
        b1(0),
        b2(0),
        b3(0),
        b4(0),
        b5(0)
    {
    }

    explicit MacAddress(const uint8_t address[6]) :
        b0(address[0]),
        b1(address[1]),
        b2(address[2]),
        b3(address[3]),
        b4(address[4]),
        b5(address[5])
    {
    }

    std::string toString() const
    {
        char str[16];
        ::sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x", b0, b1, b2, b3, b4, b5);
        return str;
    }

public:
    uint8_t b0;
    uint8_t b1;
    uint8_t b2;
    uint8_t b3;
    uint8_t b4;
    uint8_t b5;
}; // class MacAddress


} // namespace LinuxSniffer



#endif // __LINUX_SNIFFER_MAC_ADDRESS_H__

#include <cstring>
#include <netinet/ether.h>
#include "EthernetFrameV2.h"

using namespace LinuxSniffer;


bool EthernetFrameV2::init(const uint8_t * buffer, size_t buffer_size)
{
    if(buffer_size < sizeof(ether_header))
        return false;
    const ether_header * hdr = reinterpret_cast<const ether_header *>(buffer);
    if(::memcmp(&hdr->ether_type, getEthernetType(), sizeof(getEthernetType())))
        return false;
    setDataOffset(sizeof(ether_header));
    m_src_mac_addr = MacAddress(hdr->ether_shost);
    m_dest_mac_addr = MacAddress(hdr->ether_shost);
    return true;
}

Internet Protocol

#ifndef __LINUX_SNIFFER_IP_FRAME_V4_H__
#define __LINUX_SNIFFER_IP_FRAME_V4_H__

#include <string>
#include "ProtocolFrame.h"

namespace LinuxSniffer {


class IpFrameV4 :
    public ProtocolFrame
{
public:
    IpFrameV4() :
        ProtocolFrame("Internet Protocol Version 4"),
        m_header_length(0),
        m_tos(0),
        m_package_size(0),
        m_id(0),
        m_flags(0),
        m_frag_offset(0),
        m_time_to_life(0),
        m_protocol(0),
        m_checksum(0)
    {
    }

    virtual ~IpFrameV4()
    {
    }

    virtual bool init(const uint8_t * buffer, size_t buffer_size);

    const std::string & getSourceAddress() const
    {
        return m_src_ip_addr;
    }

    const std::string & getDestinationAddress() const
    {
        return m_dest_ip_addr;
    }

    uint8_t getHeaderLength() const
    {
        return m_header_length;
    }

    uint8_t getTypeOfService() const
    {
        return m_tos;
    }

    uint16_t getPackageSize() const
    {
        return m_package_size;
    }

    uint16_t getId() const
    {
        return m_id;
    }

    uint8_t getFlags() const
    {
        return m_flags;
    }

    uint16_t getFragmintationOffset() const
    {
        return m_frag_offset;
    }

    uint8_t getTimeToLife() const
    {
        return m_time_to_life;
    }

    uint8_t getProtocolId() const
    {
        return m_protocol;
    }

    uint16_t getHeaderCheckSum() const
    {
        return m_checksum;
    }

public:
    static const uint8_t m_ipv4_version = 4;

private:
    void splitFragmentOffsetAndFlags();

private:
    std::string m_src_ip_addr;
    std::string m_dest_ip_addr;
    uint8_t m_header_length;
    uint8_t m_tos;
    uint16_t m_package_size;
    uint16_t m_id;
    uint8_t m_flags;
    uint16_t m_frag_offset;
    uint8_t m_time_to_life;
    uint8_t m_protocol;
    uint16_t m_checksum;
}; // class IpFrameV4


} // namespace LinuxSniffer



#endif // __LINUX_SNIFFER_IP_FRAME_V4_H__

#include <netinet/ip.h>
#include <arpa/inet.h>
#include "IpFrameV4.h"



using namespace LinuxSniffer;

bool IpFrameV4::init(const uint8_t * buffer, size_t buffer_size)
{
    if(buffer_size < sizeof(iphdr) || 0 == buffer)
        return false;
    const iphdr * ip_header = reinterpret_cast<const iphdr *>(buffer);
    if(m_ipv4_version != ip_header->version)
        return false;
    in_addr addr;
    addr.s_addr = ip_header->saddr;
    m_src_ip_addr = ::inet_ntoa(addr);
    addr.s_addr = ip_header->daddr;
    m_dest_ip_addr = ::inet_ntoa(addr);
    m_header_length = ip_header->ihl;
    m_tos = ip_header->tos;
    m_package_size = ip_header->tot_len;
    m_id = ip_header->id;
    m_frag_offset = ip_header->frag_off;
    m_time_to_life = ip_header->ttl;
    m_protocol = ip_header->protocol;
    m_checksum = ip_header->check;
    setDataOffset(m_header_length);
    splitFragmentOffsetAndFlags();
    return true;
}

void IpFrameV4::splitFragmentOffsetAndFlags()
{
    union
    {
        struct
        {
#if __BYTE_ORDER == __LITTLE_ENDIAN
            uint16_t flags : 3;
            uint16_t frag_offset : 13;
#elif __BYTE_ORDER == __BIG_ENDIAN
            uint16_t frag_offset : 13;
            uint16_t flags : 3;
#endif
        } spl;
        uint16_t num;
    } splitter;

    splitter.num = m_frag_offset;
    m_flags = splitter.spl.flags;
    m_frag_offset = splitter.spl.frag_offset;
}

Transmission Control Protocol

#ifndef __LINUX_SNIFFER_TRANSPORT_PROTOCOL_FRAME_H__
#define __LINUX_SNIFFER_TRANSPORT_PROTOCOL_FRAME_H__

#include "ProtocolFrame.h"


namespace LinuxSniffer {


class TransportProtocolFrame :
    public ProtocolFrame
{
public:
    TransportProtocolFrame(const std::string & protocol_name) :
        ProtocolFrame(protocol_name),
        m_src_port(0),
        m_dest_port(0)
    {
    }

    virtual ~TransportProtocolFrame()
    {
    }

    uint16_t getSourcePort() const
    {
        return m_src_port;
    }

    uint16_t getDestinationPort() const
    {
        return m_dest_port;
    }

protected:
    void setSourcePort(uint16_t port)
    {
        m_src_port = port;
    }

    void setDestinationPort(uint16_t port)
    {
        m_dest_port = port;
    }

private:
    uint16_t m_src_port;
    uint16_t m_dest_port;
}; // class TransportProtocolFrame


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_TRANSPORT_PROTOCOL_FRAME_H__

#ifndef __LINUX_SNIFFER_TCP_FRAME_H__
#define __LINUX_SNIFFER_TCP_FRAME_H__

#include "TransportProtocolFrame.h"

namespace LinuxSniffer {


class TcpFrame :
    public TransportProtocolFrame
{
public:
    TcpFrame() :
        TransportProtocolFrame("Transmission Control Protocol"),
        m_sequence_number(0),
        m_ascknowledgment_number(0),
        m_flag_fin(false),
        m_flag_syn(false),
        m_flag_rst(false),
        m_flag_psh(false),
        m_flag_ack(false),
        m_flag_urg(false),
        m_window_size(0),
        m_checksum(0),
        m_urgent_ptr(0)
    {
    }

    virtual ~TcpFrame()
    {
    }

    virtual bool init(const uint8_t * buffer, size_t buffer_size);

    uint32_t getSequenceNumber() const
    {
        return m_sequence_number;
    }

    uint32_t getAscknowledgmentNumber() const
    {
        return m_ascknowledgment_number;
    }

    bool isFinFlagSet() const
    {
        return m_flag_fin;
    }

    bool isSynFlagSet() const
    {
        return m_flag_syn;
    }

    bool isRstFlagSet() const
    {
        return m_flag_rst;
    }

    bool isPshFlagSet() const
    {
        return m_flag_psh;
    }

    bool isAckFlagSet() const
    {
        return m_flag_ack;
    }

    bool isUrgFlagSet() const
    {
        return m_flag_urg;
    }

    uint16_t getWindowSize() const
    {
        return m_window_size;
    }

    uint16_t getCheckSum() const
    {
        return m_checksum;
    }

    uint16_t getUrgentPtr() const
    {
        return m_urgent_ptr;
    }

public:
    static const uint8_t m_protocol_id = 6;

private:
    uint32_t m_sequence_number;
    uint32_t m_ascknowledgment_number;
    bool m_flag_fin;
    bool m_flag_syn;
    bool m_flag_rst;
    bool m_flag_psh;
    bool m_flag_ack;
    bool m_flag_urg;
    uint16_t m_window_size;
    uint16_t m_checksum;
    uint16_t m_urgent_ptr;
}; // class TcpFrame


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_TCP_FRAME_H__

#include <netinet/tcp.h>
#include "TcpFrame.h"

using namespace LinuxSniffer;


bool TcpFrame::init(const uint8_t * buffer, size_t buffer_size)
{
    if(buffer_size < sizeof(tcphdr))
        return false;
    const tcphdr * tcp_header = reinterpret_cast<const tcphdr *>(buffer);
    setSourcePort(tcp_header->source);
    setDestinationPort(tcp_header->dest);
    setDataOffset(tcp_header->doff);
    m_sequence_number = tcp_header->seq;
    m_ascknowledgment_number = tcp_header->ack_seq;
    m_flag_fin = tcp_header->fin != 0;
    m_flag_syn = tcp_header->syn != 0;
    m_flag_rst = tcp_header->rst != 0;
    m_flag_psh = tcp_header->psh != 0;
    m_flag_ack = tcp_header->ack != 0;
    m_flag_urg = tcp_header->urg != 0;
    m_window_size = tcp_header->window;
    m_checksum = tcp_header->check;
    m_urgent_ptr = tcp_header->urg_ptr;
    return true;
}

User Datagram Protocol

#ifndef __LINUX_SNIFFER_UDP_FRAME_H__
#define __LINUX_SNIFFER_UDP_FRAME_H__

#include "TransportProtocolFrame.h"

namespace LinuxSniffer {


class UdpFrame :
    public TransportProtocolFrame
{
public:
    UdpFrame() :
        TransportProtocolFrame("User Datagram Protocol")
    {
    }

    virtual ~UdpFrame()
    {
    }

    virtual bool init(const uint8_t * buffer, size_t buffer_size);

    uint16_t getDatagramLength() const
    {
        return m_datagram_length;
    }

    uint16_t getCheckSum() const
    {
        return m_checksum;
    }

public:
    static const uint8_t m_protocol_id = 17;

private:
    uint16_t m_datagram_length;
    uint16_t m_checksum;
}; // class UdpFrame


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_UDP_FRAME_H__

#include <netinet/udp.h>
#include "UdpFrame.h"

using namespace LinuxSniffer;


bool UdpFrame::init(const uint8_t * buffer, size_t buffer_size)
{
    if(buffer_size < sizeof(udphdr))
        return false;
    const udphdr * udp_header = reinterpret_cast<const udphdr *>(buffer);
    setSourcePort(udp_header->source);
    setDestinationPort(udp_header->dest);
    setDataOffset(sizeof(udphdr));
    m_datagram_length = udp_header->len;
    m_checksum = udp_header->check;
    return true;
}

Анализатор

#ifndef __LINUX_SNIFFER_IP_ANALYZER_H__
#define __LINUX_SNIFFER_IP_ANALYZER_H__

#include <utility>
#include "Analyzer.h"


namespace LinuxSniffer {

class TransportProtocolFrame;

class IpAnalyzer :
    public Analyzer
{
public:
    virtual ~IpAnalyzer() { }
    virtual void analyze(const uint8_t * frame, size_t frame_size);

private:
    size_t tryEthV2Analyze(const uint8_t * frame, size_t frame_size);
    std::pair<size_t, uint8_t> tryIpV4Analyze(const uint8_t * frame, ize_t frame_size);
    size_t tryTcpAnalyze(const uint8_t * frame, size_t frame_size);
    size_t tryUdpAnalyze(const uint8_t * frame, size_t frame_size);
    void printTransportProtocolFrame(const TransportProtocolFrame & frame) const;
}; // class IpAnalyzer


} // namespace LinuxSniffer


#endif // __LINUX_SNIFFER_IP_ANALYZER_H__

#include <iostream>
#include "IpAnalyzer.h"
#include "EthernetFrameV2.h"
#include "IpFrameV4.h"
#include "TcpFrame.h"
#include "UdpFrame.h"

using namespace LinuxSniffer;

void IpAnalyzer::analyze(const uint8_t * frame, size_t frame_size)
{
    const size_t ip_offset = tryEthV2Analyze(frame, frame_size);
    if(0 == ip_offset)
        return;

    const uint8_t * ip_frame = &frame[ip_offset];
    const size_t ip_frame_size = frame_size - ip_offset;
    std::pair<size_t, uint8_t> ip_analyze_result =
        tryIpV4Analyze(ip_frame, ip_frame_size);
    if(0 == ip_analyze_result.first)
        return;


    const uint8_t * transport_frame = ip_frame + ip_analyze_result.first;
    const size_t transport_frame_size = ip_frame_size - ip_analyze_result.first;
    size_t application_protocol_data_offset;
    switch(ip_analyze_result.second)
    {
    case TcpFrame::m_protocol_id:
        application_protocol_data_offset = tryTcpAnalyze(
            transport_frame, transport_frame_size);
        break;
    case UdpFrame::m_protocol_id:
        application_protocol_data_offset = tryUdpAnalyze(
            transport_frame, transport_frame_size);
        break;
    default:
        std::cout << "======= Unsupported transport protocol ======n";
    }

    std::cout << std::endl;
}

size_t IpAnalyzer::tryEthV2Analyze(const uint8_t * frame, size_t frame_size)
{
    EthernetFrameV2 eth_frame;
    if(!eth_frame.init(frame, frame_size))
        return 0;

    std::cout << "====== " << eth_frame.getName() << " ======n" <<
        "Source MAC Address: " << eth_frame.getSourceMacAddress().toString() <<
        std::endl << "Destination MAC Address: " <<
        eth_frame.getDestinationMacAddress().toString() << std::endl;

    return eth_frame.getDataOffset();
}

std::pair<size_t, uint8_t> IpAnalyzer::tryIpV4Analyze(const uint8_t * frame,
    size_t frame_size)
{
    IpFrameV4 ip_frame;
    if(!ip_frame.init(frame, frame_size))
        return std::make_pair(0, 0);

    std::cout << "====== " << ip_frame.getName() << " ======n" <<
        "Source IP Address: " << ip_frame.getSourceAddress() << std::endl <<
        "Destination IP Address: " << ip_frame.getDestinationAddress() <<
        std::endl <<
        "Header Length: " << std::dec <<
        static_cast<uint32_t>(ip_frame.getHeaderLength()) << std::endl <<
        "Type Of Service: " <<
        static_cast<uint32_t>(ip_frame.getTypeOfService())<< std::endl <<
        "Package Size: "<< ip_frame.getPackageSize() << std::endl <<
        "Identification: " << ip_frame.getId() << std::endl <<
        "Flags: " << static_cast<uint32_t>(ip_frame.getFlags())<< std::endl <<
        "Fragmentation Offset: " <<    ip_frame.getFragmintationOffset() <<
         std::endl <<
        "Time To Live: " <<    static_cast<uint32_t>(ip_frame.getTimeToLife()) <<
         std::endl <<
        "Transport Protocol ID: " <<
        static_cast<uint32_t>(ip_frame.getProtocolId()) << std::endl <<
        "CRC-16 Header CheckSum:" << std::hex << ip_frame.getHeaderCheckSum() <<
         std::endl;
    return std::make_pair(ip_frame.getDataOffset(), ip_frame.getProtocolId());
}

size_t IpAnalyzer::tryTcpAnalyze(const uint8_t * frame, size_t frame_size)
{
    TcpFrame tcp_frame;
    if(!tcp_frame.init(frame, frame_size))
        return 0;

    printTransportProtocolFrame(tcp_frame);

    std::cout << std::dec <<
    "Sequence Number: " << tcp_frame.getSequenceNumber() << std::endl <<
    "Ascknowledgment Number: " << tcp_frame.getAscknowledgmentNumber() <<
    std::endl <<
    "Window Size: " << tcp_frame.getWindowSize() << std::endl <<
    "Urgent Pointer: " << tcp_frame.getUrgentPtr() << std::endl <<
    "Flags:n" <<
    "    FIN: " << std::boolalpha << tcp_frame.isFinFlagSet() << std::endl <<
    "    SYN: " << tcp_frame.isSynFlagSet() << std::endl <<
    "    RST: " << tcp_frame.isRstFlagSet() << std::endl <<
    "    PSH: " << tcp_frame.isPshFlagSet() << std::endl <<
    "    ACK: " << tcp_frame.isAckFlagSet() << std::endl <<
    "    URG: " << tcp_frame.isUrgFlagSet() << std::endl <<
    "CheckSum: " << std::hex << tcp_frame.getCheckSum() << std::endl;

    return tcp_frame.getDataOffset();
}

size_t IpAnalyzer::tryUdpAnalyze(const uint8_t * frame, size_t frame_size)
{
    UdpFrame udp_frame;
    if(!udp_frame.init(frame, frame_size))
        return 0;

    printTransportProtocolFrame(udp_frame);
    std::cout << std::dec <<
        "Datagram Length: " << std::dec << udp_frame.getDatagramLength() <<
         std::endl <<
         "Datagram CheckSum: " << std::hex << udp_frame.getCheckSum() <<
         std::endl;
    return udp_frame.getDataOffset();
}

void IpAnalyzer::printTransportProtocolFrame(
    const TransportProtocolFrame & frame) const
{
    std::cout << "====== " << frame.getName() << " ======n" <<
        std::dec << "Source Port: " << frame.getSourcePort() << std::endl <<
        "Destination Port: " << frame.getDestinationPort() <<
        std::endl;
}

Заключение