😸Wirecat

A Not Simple Network Sniffer.

Environment

• Ubuntu 20.04
• Qt 5.9.0
• libpcap 1.10.1

Dependencies

$ sudo apt-get install qtbase5-dev qtchooser qt5-qmake qtbase5-dev-tools
$ sudo apt-get install libpcap-dev

Structure

• src/ - Source code
  • src/utils/ - Utility functions
  • src/utils/utils.h - Utility functions header
  • src/utils/utils.cpp - Utility functions implementation
  • src/utils/hdr.h - Package header information
  • src/main.cpp - Main function
  • src/mainwindow.cpp - Main window
  • src/mainwindow.h - Main window header
  • src/sniffer.cpp - Sniffer
  • src/sniffer.h - Sniffer header
  • src/catch.h - Catch package
  • src/catch.cpp - Catch package implementation
  • src/filter.h - Filter header
  • src/filter.cpp - Filter
  • src/devwindow.h - Devwindow header
  • src/devwindow.cpp - Devwindow
• ui/ - UI files
  • ui/mainwindow.ui - Main window UI
• build/ - Build directory
  • build/build.sh - Build script
  • build/sniffer.pro - Project file
  • build/Makefile - Makefile
  • build/bin/ - Executable directory
    • build/bin/sniffer - Executable file
• test/ - Test directory
  • Makefile - Makefile
  • test/test.cpp - Test file

Build & Run

Use build.sh script:

# build
$ cd build
$ bash build.sh
# run
$ ./bin/sniffer

Manually:

# build
$ cd ./build
$ qmake -o Makefile ./sniffer.pro
$ make
# run
$ cd ./bin
$ chmod +x ./sniffer 
$ ./sniffer

Test

Test sniffer in terminal:

$ cd test
# make clean if necessary
$ make
$ sudo ./test

Save to log file:

$ cd test
$ mkdir log
# make clean if necessary
$ make
$ echo "eth0" > test.in # change "eth0" to your device
$ sudo ./test < test.in > ./log/"$(date +"%Y-%m-%d_%H-%M-%S").log"

TODO

• GUI framework
• Find all network devices
• Catch packets
• Parse packets (Parse IP, TCP, UDP, ICMP, ARP, etc.)
• IP fragmentation reassembly
• Filter packets (Filter IP addresses (src & dst), ports (src & dst), protocols, etc.)
• Search packets (Search by content, etc.)
• Save packets (Save packets to readable file)
• File reassembly (Reassemble files from TCP packets)
• Interact in GUI (Show packets info in GUI)
• Beautify UI (QStyle class may be helpful)

Reference

Resources

• Getting Started with qmake
• pcap tutorial
• sniffex.c
• libpcap packet capture tutorial
• Qt groupbox example
• pcap

Q&A

• QGroupBox find selected Radio Button
• Qt forward declaration problem
• Include Qt path in vscode-clangd