<?php
/*
   PHP Packet Sniffer
   Copyright 2006, David Eder
*/

/*
Example:

  $sniffer = new sniffer();
  $sniffer->add_protocol(SOL_UDP, 'print_r');
  $sniffer->add_protocol(SOL_TCP, 'print_r');
  $sniffer->add_protocol(SOL_ICMP, 'print_r');
  $sniffer->listen();
*/

  if(!defined('SOL_ICMP')) define('SOL_ICMP', 1);
  class sniffer
  {
    var $addr;
    var $sockets = array();
    var $callback = array();

    function sniffer($default_callback)
    {
      $socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
      socket_connect($socket, '64.0.0.0', 0);
      socket_getsockname($socket, $this->addr, $port);
      socket_close($socket);
      $this->callback['default'] = $default_callback;
    }

    function add_protocol($protocol, $callback)
    {
      if($sock = @socket_create(AF_INET, SOCK_RAW, $protocol))
      {
        socket_set_option($sock, SOL_SOCKET, SO_REUSEADDR, 1);
        $this->sockets[] = $sock;
        $this->callback[$protocol] = $callback;
        return true;
      }
      return false;
    }

    function listen()
    {
      $w = $e = NULL;
      do
      {
        $active = $this->sockets;
        socket_select($active, $w, $e, NULL);
        foreach($active as $sock)
        {
          $ip = array();
          if(socket_recv($sock, $packet, 65536, 0))
          {
            $this->decode($packet);
          }
        }
      } while(true);
    }

    function decode($packet)
    {
      // decode ip header
      $ip['version'] = ord($packet{0}) >> 4;
      $ip['ihl'] = ord($packet{0}) & 0xf;
      $ip['tos'] = ord($packet{1});
      $ip['length'] = (ord($packet{2}) << 8) + ord($packet{3});
      $ip['id'] = (ord($packet{4}) << 8) + ord($packet{5});
      $ip['flags'] = ord($packet{6});
      $ip['fragment_offset'] = ord($packet{7});
      $ip['ttl'] = ord($packet{8});
      $ip['protocol'] = ord($packet{9});
      $ip['checksum'] = (ord($packet{10}) << 8) + ord($packet{11});
      $ip['source'] = ord($packet{12}) . '.' . ord($packet{13}) . '.' . ord($packet{14}) . '.' . ord($packet{15});
      $ip['dest'] = ord($packet{16}) . '.' . ord($packet{17}) . '.' . ord($packet{18}) . '.' . ord($packet{19});
      $payload = substr($packet, $ip['ihl'] << 2);

      switch($ip['protocol'])
      {
        case SOL_ICMP:
          $ip['icmp']['type'] = ord($payload{0});
          $ip['icmp']['code'] = ord($payload{1});
          $ip['icmp']['checksum'] = (ord($payload{2}) << 8) + ord($payload{3});
          $ip['icmp']['payload'] = substr($payload, 4);
          if(is_callable($this->callback[SOL_ICMP])) $this->callback[SOL_ICMP]($ip);
          break;
        case SOL_UDP:
          $ip['udp']['src_port'] = (ord($payload{0}) << 8) + ord($payload{1});
          $ip['udp']['dst_port'] = (ord($payload{2}) << 8) + ord($payload{3});
          $ip['udp']['length'] = (ord($payload{4}) << 8) + ord($payload{5});
          $ip['udp']['checksum'] = (ord($payload{6}) << 8) + ord($payload{7});
          $z = getservbyport($ip['udp']['src_port'], 'udp');
          if(!$z) getservbyport($ip['udp']['dst_port'], 'udp');
          if(!$z) $z = 'unknown';
          $ip['udp'][$z] = "\n" . $this->hexdump(substr($payload, 8));
          if(is_callable($this->callback[SOL_UDP])) $this->callback[SOL_UDP]($ip);
          break;
        case SOL_TCP:
          $ip['tcp']['src_port'] = (ord($payload{0}) << 8) + ord($payload{1});
          $ip['tcp']['dst_port'] = (ord($payload{2}) << 8) + ord($payload{3});
          $ip['tcp']['sequence'] = (ord($payload{4}) * 65536) + (ord($payload{5}) << 16) + (ord($payload{6}) << 8) + ord($payload{7});
          $ip['tcp']['ack_number'] = (ord($payload{8}) * 65536) + (ord($payload{9}) << 16) + (ord($payload{10}) << 8) + ord($payload{11});
          $ip['tcp']['offset'] = ord($payload{12});
          $ip['tcp']['reserved'] = ord($payload{13});
          $ip['tcp']['control'] = ord($payload{14});
          $ip['tcp']['window'] = ord($payload{15});
          $ip['tcp']['checksum'] = (ord($payload{16}) << 8) + ord($payload{17});
          $ip['tcp']['urgent'] = (ord($payload{18}) << 8) + ord($payload{19});
          $z = getservbyport($ip['tcp']['src_port'], 'tcp');
          if(!$z) getservbyport($ip['tcp']['dst_port'], 'tcp');
          if(!$z) $z = 'unknown';
          $ip['tcp'][$z] = "\n" . $this->hexdump(substr($payload, $ip['tcp']['offset']));;
          if(is_callable($this->callback[SOL_TCP])) $this->callback[SOL_TCP]($ip);
          break;
        default:
          $ip[getprotobynumber($ip['protocol'])] = "\n" . $this->hexdump($payload);
          if(is_callable($this->callback['default'])) $this->callback['default']($ip);
          break;
      }
    }

    function full_sniffer($callback)
    {
      foreach(file('/etc/protocols') as $line)
      {
        list($line) = explode('#', $line);
        $line = trim($line);
        if($line == '') continue;
        $line = strtr($line, "\t", ' ');
        while(strpos($line, '  ')) $line = str_replace('  ', ' ', $line);
        list($name, $number) = explode(' ', $line);
        $this->add_protocol($number, $callback);
      }
    }

    function hexdump($data)
    {
      $ret = '';
      $ascii = '';
      for($i = 0; $i < strlen($data); $i++)
      {
        $c = ord($data{$i});
        if($c > 31 && $c < 128) $ascii .= $data{$i}; else $ascii .= '.';
        if($i % 16 == 0) $ret .= ' ';
        elseif($i % 8 == 0) $ret .= '   ';
        $ret .= ' ' . str_pad(dechex($c), 2, '0', STR_PAD_LEFT);
        if(($i + 1) % 16 == 0)
        {
          $ret .= "\t$ascii\n";
          $ascii = '';
        }
      }
      while($i % 16 != 0)
      {
        if($i % 8 == 0) $ret .= '    ';
        $ret .= '   ';
        $i++;
      }
      return "$ret\t$ascii\n";
    }
  }
?>