arpscan (b493faa6) · Commits · nimrod / masscan

src/logger.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -14,7 +14,7 @@
		#include <stdio.h>

		int verbosity = 0; /* yea! a global variable!! */

		int debuglevel = 0;

		/***************************************************************************
		***************************************************************************/

src/logger.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -2,6 +2,7 @@
		#define LOGGER_H

		extern int verbosity; /* defined in logger.c */
		extern int debuglevel;

		void LOG(int level, const char *fmt, ...);
		void LOGip(int level, unsigned ip, unsigned port, const char *fmt, ...);

src/main-conf.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -629,6 +629,7 @@ masscan_set_parameter(struct Masscan *masscan,
		range.end = Templ_ARP;
		rangelist_add_range(&masscan->ports, range.begin, range.end);
		masscan_set_parameter(masscan, "router-mac", "ff-ff-ff-ff-ff-ff");
		masscan->is_arp = 1; /* needs additional flag */
		LOG(5, "--arpscan\n");
		} else if (EQUALS("ping", name) \|\| EQUALS("ping-sweep", name)) {
		/* Add ICMP ping request */
		@@ -1098,8 +1099,10 @@ masscan_command_line(struct Masscan masscan, int argc, char argv[])
		case 'd': /* just do same as verbosity level */
		{
		int v;
		for (v=1; argv[i][v] == 'v'; v++)
		for (v=1; argv[i][v] == 'v'; v++) {
		verbosity++;
		debuglevel++;
		}
		}
		break;
		case 'e':

src/main-ptrace.c

+12 −10

Original line number	Diff line number	Diff line
		@@ -35,14 +35,14 @@ packet_trace(FILE fp, const unsigned char px, size_t length, unsigned is_sent)
		return;
		offset = parsed.found_offset;

		src_ip = px[parsed.ip_offset + 12] << 24
		\| px[parsed.ip_offset + 13] << 16
		\| px[parsed.ip_offset + 14] << 8
		\| px[parsed.ip_offset + 15];
		dst_ip = px[parsed.ip_offset + 16] << 24
		\| px[parsed.ip_offset + 17] << 16
		\| px[parsed.ip_offset + 18] << 8
		\| px[parsed.ip_offset + 19];
		src_ip = parsed.ip_src[0] << 24
		\| parsed.ip_src[1] << 16
		\| parsed.ip_src[2] << 8
		\| parsed.ip_src[3];
		dst_ip = parsed.ip_dst[0] << 24
		\| parsed.ip_dst[1] << 16
		\| parsed.ip_dst[2] << 8
		\| parsed.ip_dst[3];

		/* format the IP addresses into fixed-width fields */
		sprintf_s(from, sizeof(from), "%u.%u.%u.%u:%u",
		@@ -58,9 +58,11 @@ packet_trace(FILE fp, const unsigned char px, size_t length, unsigned is_sent)
		switch (parsed.found) {
		case FOUND_ARP:
		type = px[offset+6]<<8 \| px[offset+7];
		*strchr(to, ':') = '\0';
		*strchr(from, ':') = '\0';
		switch (type) {
		case 0:strcpy_s(sz_type, sizeof(sz_type), "request"); break;
		case 1:strcpy_s(sz_type, sizeof(sz_type), "response"); break;
		case 1:strcpy_s(sz_type, sizeof(sz_type), "request"); break;
		case 2:strcpy_s(sz_type, sizeof(sz_type), "response"); break;
		default: sprintf_s(sz_type, sizeof(sz_type), "unknown(%u)", type); break;
		}
		fprintf(fp, "%s (%5.4f) ARP %-21s > %-21s %s\n", direction,

src/main.c

+42 −8

Original line number	Diff line number	Diff line
		@@ -41,6 +41,7 @@
		#include "pixie-threads.h" /* portable threads */
		#include "templ-payloads.h" /* UDP packet payloads */
		#include "proto-snmp.h" /* parse SNMP responses */
		#include "templ-port.h"

		#include <limits.h>
		#include <string.h>
		@@ -557,15 +558,39 @@ receive_thread(void *v)
		*/
		switch (parsed.found) {
		case FOUND_ARP:
		/* OOPS: handle arp instead. Since we may completely bypass the TCP/IP
		* stack, we may have to handle ARPs ourself, or the router will
		* lose track of us. */
		LOGip(2, ip_them, 0, "-> ARP [%u] \n", px[parsed.found_offset]);
		switch (px[parsed.found_offset + 6]<<8 \| px[parsed.found_offset+7]) {
		case 1: /* request */
		/* This function will transmit a "reply" to somebody's ARP request
		* for our IP address (as part of our user-mode TCP/IP).
		* Since we completely bypass the TCP/IP stack, we have to handle ARPs
		* ourself, or the router will lose track of us.*/
		arp_response( parms->adapter_ip,
		parms->adapter_mac,
		px, length,
		parms->packet_buffers,
		parms->transmit_queue);
		break;
		case 2: /* response */
		/* This is for "arp scan" mode, where we are ARPing targets rather
		* than port scanning them */

		/* If we aren't doing an ARP scan, then ignore ARP responses */
		if (!masscan->is_arp)
		break;

		/* If this response isn't in our range, then ignore it */
		if (!rangelist_is_contains(&masscan->targets, ip_them))
		break;

		/* Ignore duplicates */
		if (dedup_is_duplicate(dedup, ip_them, 0))
		continue;

		/* ...everything good, so now report this response */
		handle_arp(out, px, length, &parsed);
		break;
		}
		continue;
		case FOUND_UDP:
		case FOUND_DNS:
		@@ -789,6 +814,15 @@ main_scan(struct Masscan *masscan)
		}
		range = count_ips * count_ports + (uint64_t)(masscan->retries * masscan->max_rate);

		/*
		* If doing an ARP scan, then don't allow port scanning
		*/
		if (rangelist_is_contains(&masscan->ports, Templ_ARP)) {
		if (masscan->ports.count != 1) {
		LOG(0, "FAIL: cannot arpscan and portscan at the same time\n");
		return 1;
		}
		}

		/*
		* If the IP address range is very big, then require that that the