混杂模式下的数据包套接字仅接收本地流量
我有一个使用 socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) 创建的套接字，并且我已使用以下方法将其设置为混杂模式：
struct ifreq ifr;
strncpy((char*)ifr.ifr_name, interface, IF_NAMESIZE);
if(ioctl(sock, SIOCGIFINDEX, &ifr)<0) fail(2);
struct packet_mreq mr;
memset(&mr, 0, sizeof(mr));
mr.mr_ifindex = ifr.ifr_ifindex;
mr.mr_type = PACKET_MR_PROMISC;
if(setsockopt(sock, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) < 0) fail(2);
问题是，当我执行 read() 从套接字，它只返回来自或传入我的计算机的数据。
我怎样才能让它读取和处理网络上的所有数据包？
Wireshark 可以正常显示所有数据包，因此我知道这不是我的计算机或网卡。 ifconfig 报告其运行时为 PROMISC。
I have a socket created with socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), and I've set it into promiscuous mode using:
struct ifreq ifr;
strncpy((char*)ifr.ifr_name, interface, IF_NAMESIZE);
if(ioctl(sock, SIOCGIFINDEX, &ifr)<0) fail(2);
struct packet_mreq mr;
memset(&mr, 0, sizeof(mr));
mr.mr_ifindex = ifr.ifr_ifindex;
mr.mr_type = PACKET_MR_PROMISC;
if(setsockopt(sock, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) < 0) fail(2);
The problem is that when I do a read() from the socket, it only returns data that's going from or coming to my computer.
How can I get it to read and process all packets on the network?
Wireshark shows all the packets fine, so I know it isn't my computer or NIC. ifconfig reports that it's PROMISC when it is running.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
根据 Rob Jones 的建议，尝试使用 Wireshark 之类的工具，以确保您收到的数据包符合你期望在界面上。至少这会确认（或否认）您的代码有问题。
还需要确保接口本身设置为混杂模式。
如果没有，那么您可以使用 ioctl() 来设置它：
当您的应用程序运行时，请确保 ifconfig 报告该接口的 PROMISC 标志。
请注意，这需要以特权用户身份执行。
尝试了所提供的代码。对我有用。当然（由于第 102 行的测试）这只会打印 TCP 流量的详细信息。
Along with Rob Jones' suggestion, try a tool like Wireshark to make sure that you're receiving the packets that you expect at the interface. At least that will confirm (or deny) that you have a problem with your code.
Also need to make sure that the interface itself is set to promiscuous mode.
If not then you can use the ioctl() to set it:
While your application is running, make sure that ifconfig reports the PROMISC flag for that interface.
Note that this will need to be executed as a privileged user.
Tried out the code as presented. Works for me. Of course (due to the test on line 102) this will only print details for TCP traffic.
尝试使用 SOCK_PACKET 作为 socket() 的第二个参数，而不是 SOCK_RAW。
如果您使用的是交换机，您可能只会看到发往或源自您的计算机的数据包。尝试使用集线器。
Try using SOCK_PACKET as the second argument to socket(), rather than SOCK_RAW.
If you're on a switch you will probably only see packets destined to, or originating from your computer. Try a hub.
这可能不是软件问题。
您可能使用了错误的硬件。您的计算机可能已连接到 Switch。
交换机足够聪明，可以“了解”哪些计算机位于哪些端口上，并将流量仅路由到需要去的地方。因此，交换机正在为您过滤数据包。
要解决此问题，您需要获得一个集线器。尽管集线器和交换机看起来非常相似，但它们的工作方式不同。集线器是哑的，会将所有流量路由到所有端口，使您能够以混杂模式查看其他流量。
请注意，即使您更换计算机连接的设备，它也可能连接到更多上游交换机，这也会限制流量。因此，您将无法从比您自己的集线器或测试实验室设置更远的地方嗅探流量。
This is likely not a software problem.
You're likely using the wrong hardware. Your computer is probably hooked up to a Switch.
Switches are smart enough to "learn" which computers are on which ports, and route traffic only to where it needs to go. Hence, the switch is filtering your packets for you.
To fix this, you need to get a Hub. Although Hubs and Switches appear very similar, they work differently. The Hub is dumb, and will route all traffic to all ports, enabling you to see other traffic in promiscuous mode.
Note that even if you replace the device that your computer connects to, it is likely connected to more switches up-stream, which will also limit traffic. Hence, you won't be able to sniff traffic from much further away than your own hub or test-lab setup.
您的交换机端口还需要进行适当配置（Cisco 世界中的 SPAN 端口）。
请参阅此处了解更多详细信息：
http://www.winpcap.org/misc/ faq.htm#Q-22
以下是 Cisco 提供的有关 SPAN 端口如何工作的信息：
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml
Your switch port also needs to be configured appropriately (SPAN port in Cisco world).
See here for more details:
http://www.winpcap.org/misc/faq.htm#Q-22
And here is the info from Cisco regarding how SPAN ports work:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml