我正在嘗試創(chuàng)建

linux內(nèi)核模塊,它將檢查傳入的數(shù)據(jù)包.目前,我正在提取數(shù)據(jù)包的TCP標(biāo)頭并讀取源和目標(biāo)端口 – >但是我得到的值不正確.我有鉤功能：

unsigned int hook_func(unsigned int hooknum,struct sk_buff *skb,const struct net_device *in,const struct net_device *out,int (*okfn)(struct sk_buff *))

{

struct iphdr *ipp = (struct iphdr *)skb_network_header(skb);

struct tcphdr *hdr;

/* Using this to filter data from another machine */

unsigned long ok_ip = 2396891328;

/* Some problem,empty network packet. Stop it now. */

if (!skb)

return NF_ACCEPT;

/* Just to track only packets coming from 1 IP */

if (ipp->saddr != ok_ip)

return NF_ACCEPT;

/* Incomming packet is TCP */

if (ipp->protocol == IPPROTO_TCP) {

hdr = (struct tcphdr *) skb_transport_header(skb);

printk(" TCP ports: source: %d,dest: %d .\n",ntohs(hdr->source),ntohs(hdr->dest));

}

}

現(xiàn)在,當(dāng)我嘗試telnet端口21(我沒有收聽)：

[ 4252.961912] TCP ports: source: 17664,dest: 52 .

[ 4253.453978] TCP ports: source: 17664,dest: 52 .

[ 4253.953204] TCP ports: source: 17664,dest: 48 .

當(dāng)我telnet端口22 – SSH deamon在那里聽：

[ 4299.239940] TCP ports: source: 17664,dest: 52 .

[ 4299.240527] TCP ports: source: 17664,dest: 40 .

[ 4299.552566] TCP ports: source: 17664,dest: 40 .

從輸出可見我得到了非常奇怪的結(jié)果,任何人都知道問題來自哪里？當(dāng)我編譯模塊時(shí),我沒有錯(cuò)誤/警告.內(nèi)核版本(標(biāo)題)：3.7.10.不使用SELinux或類似的.

總結(jié)

以上是生活随笔為你收集整理的linux tcp 内核模块,C – Linux – 内核模块 – TCP头的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。