I am trying to capture packages. In my "exploration" example I use the IP of a website that I visit in the browser. I am using PCAP4J to capture package information.
Based on step 3 on https://www.pcap4j.org/ I have the impression that I can simply have an internet address and start listening to it:
InetAddress addr = InetAddress.getByName("192.168.10.100");
PcapNetworkInterface nif = Pcaps.getDevByAddress(addr);
However, when I change this ip to my personal example (185.57.10.32) the nif returns null.
I have printed out a list of PcapNetworkInterfaces as follows:
System.out.println("#### LIST OF DEVS ####");
List<PcapNetworkInterface> devices = Pcaps.findAllDevs();
for (PcapNetworkInterface device : devices) {
System.out.println(device.getName());
}
System.out.println("###############");
Which returns the following:
wlp2s0
any
lo
docker0
enp3s0f1
br-df16c72d2764
bluetooth0
nflog
nfqueue
usbmon1
usbmon2
So in that sense I understand that nif returns null as it is not in the list. However, it makes me not understand why the example given by the author is not workign as I expect.
So I think the first question would be: Can one listen to a specific ip via Pcap4J? In this case an ip of a website. Or are websites not possible and should I make another test case?
Thank you!
An IP addreess you should pass to Pcaps.getDevByAddress() is one a NIF has.
You can capture packets from any IP addresses with the NIF.
Related
I am deplyong a web application in the Internet and I am checking whether the user's login is valid by checking its client IP address (e.g. 192.168.2.XXX). Actually, I have found a working code (below). This code was completely working before, but after some time, its output is not the same anymore. Now, this code only gives me 1 IP address which is the server's IP address. What is wrong with my code? How can I get the client's static IP address rather than the server's IP address? I have also tried other solutions such as getRemoteAddr() and request.getHeader("PROXY-CLIENT-IP") but it is not working.
Java:
String ipAddress = request.getHeader("X-FORWARDED-FOR");
if(ipAddress == null)
ipAddress = InetAddress.getLocalHost().getHostAddress();
Your are mixing two levels of abstractions and that is rarely a good thing.
The header X-FORWARDED_FOR is inserted by a load balancer or proxy. If the client reaches the server directly, then this header isn't present and you are executing this code InetAddress.getLocalHost().getHostAddress();. Which does exactly what you say: It is retrieving the IP address of the host where this piece of code is running, i.e. the web server.
See also here: Getting the client IP address: REMOTE_ADDR, HTTP_X_FORWARDED_FOR, what else could be useful?
I'm trying to write a program that will show a DHCP client list in Java. I want to get the IP addresses, MAC addresses and the host names of all the devices connected to my wifi network.
I have a Belkin router. Its homepage has a 'DHCP client list' option which when clicked shows me this table :
That's exactly what I'm looking for. But I want to show all this data in the form of a list in a Java Swing program. I also want to be able to update this list by pressing a refresh button. Is there any way to achieve this?
It should look something like this :
I've written a basic java program that shows all the IP addresses that are online. Here's the code :
public static void main(String[] args) throws IOException {
InetAddress localhost = InetAddress.getLocalHost();
// this code assumes IPv4 is used
byte[] ip = localhost.getAddress();
for (int i = 1; i <= 254; i++)
{
ip[3] = (byte)i;
InetAddress address = InetAddress.getByAddress(ip);
if (address.isReachable(1000))
{
// machine is turned on and can be pinged
System.out.println(address + "is online");
}
else if (!address.getHostAddress().equals(address.getHostName()))
{
// machine is known in a DNS lookup
System.out.println(address + "is in a DNS lookup");
}
else
{
// the host address and host name are equal, meaning the host name could not be resolved
System.out.println(address + " is not online");
}
}
}
But this doesn't serve the purpose and it's really slow. I want to write a Swing program that'll show me the DHCP client list as seen in the image above.
Any help is appreciated.
I would think about three possible alternatives:
1-The one you implemented that is slow but it can work. You need to find a JAVA API to get the MAC addresses of received messages (I don't know if it exists or not). You can also send ARP messages asking "who has this IP address) and obtain the MAC address from the response. Use some Java interface for pcap library: jNetPcap vs Jpcap , http://jnetpcap.com/
2-Create an app that accesses your router web interface using HTTP and sending the appropriate messages with data as if you were using the UI. In this way you can programatically follow the steps a human would go and get the list that you browser shows, parse it and obtain the data.
3-If the router/access point provides a web API, which I doubt, you can use it.
I need to see if a request is coming from a certain domain (www.domain.com).
So far, I only know how to get the IP address of the request (by using the request.getRemoteHost() method). The problem is that one domain might map to a lot of different IP addresses (for balance purposes), so I can not do something like this:
request.getRemoteHost().equals("200.50.40.30")
because there might be different IP address returned by the DNS when it resolves www.domain.com.
I want to be able to do something like this:
request.getRemoteHost().equals("www.domain.com")
But so far, I have no clue (and Google didn't help me) on how to do that.
Does somebody have any ideas??
Thank you in advance! :)
Can you just feed IP to InetAddress and call getCanonnicalHostName()?
After contacting the domain I was trying to verify the request was coming from, they provided me the whole range of IPs their servers might start a request from. Having all those IPs and masks in hands, this is what I did to verify the request was coming from them:
//Those IPs and Maks were provided by the domain
String[] ipsAndMasks = { "AAA.BBB.CCC.DDD/26",
"EEE.BBB.CCC.DDD/24",
"FFF.BBB.CCC.DDD/29",
"GGG.BBB.CCC.DDD/22"};
Collection<SubnetInfo> subnets = new ArrayList<SubnetInfo>();
for (String ipAndMask : ipsAndMasks) {
subnets.add(new SubnetUtils(ipAndMask).getInfo());
}
boolean requestIsComingFromTheCorrectDomain = false;
String ipAddress = request.getRemoteAddr();
for (SubnetInfo subnet : subnets) {
if (subnet.isInRange(ipAddress)) {
requestIsComingFromTheCorrectDomain = true;
break;
}
}
Hope this code also helps someone!
I'm programming a simple web browser depending on NanoHTTPD project and it's required to get number of visitors using the IP address.
Are there any ways to get the client IP using NanoHTTPD?
In NanoHTTPD.java, find the private class HTTPSession object.
Inside this is public void run(). Find the following line and add the second line after it.
decodeHeader(hin, pre, parms, header);
header.put("IPAddress", mySocket.getInetAddress().getHostAddress());
Now inside your serve function, you can just reference the IPAddress header to get the client's ip address.
I know the answer is probably too late to help you, but hopefully it'll help others searching for the same thing.
I found in the latest master branch, you can get the client ip address by header "http-client-ip" in the IHTTPSession session object.
This code used to return my local ip address as 192.xxx.x.xxx but now it is returning 127.0.0.1 . Please help me why the same code is returning different value. Is there something that I need to watch at linux OS.
import java.util.*;
import java.lang.*;
import java.net.*;
public class GetOwnIP
{
public static void main(String args[]) {
try{
InetAddress ownIP=InetAddress.getLocalHost();
System.out.println("IP of my system is := "+ownIP.getHostAddress());
}catch (Exception e){
System.out.println("Exception caught ="+e.getMessage());
}
}
}
127.0.0.1 is the loopback adapter - it's a perfectly correct response to the (somewhat malfomed) question "what is my IP address?"
The problem is that there are multiple correct answers to that question.
EDIT: The docs for getLocalHost say:
If there is a security manager, its
checkConnect method is called with the
local host name and -1 as its
arguments to see if the operation is
allowed. If the operation is not
allowed, an InetAddress representing
the loopback address is returned.
Is it possible that the change in behaviour is due to a change in permissions?
EDIT: I believe that NetworkInterface.getNetworkInterfaces is what you need to enumerate all the possibilities. Here's an example which doesn't show virtual addresses, but works for "main" interfaces:
import java.net.*;
import java.util.*;
public class Test
{
public static void main(String[] args)
throws Exception // Just for simplicity
{
for (Enumeration<NetworkInterface> ifaces =
NetworkInterface.getNetworkInterfaces();
ifaces.hasMoreElements(); )
{
NetworkInterface iface = ifaces.nextElement();
System.out.println(iface.getName() + ":");
for (Enumeration<InetAddress> addresses =
iface.getInetAddresses();
addresses.hasMoreElements(); )
{
InetAddress address = addresses.nextElement();
System.out.println(" " + address);
}
}
}
}
(I'd forgotten just how awful the Enumeration<T> type is to work with directly!)
Here are the results on my laptop right now:
lo:
/127.0.0.1
eth0:
/169.254.148.66
eth1:
eth2:
ppp0:
/10.54.251.111
(I don't think that's giving away any hugely sensitive information :)
If you know which network interface you want to use, call NetworkInterface.getByName(...) and then look at the addresses for that interface (as shown in the code above).
When you use InetAddress.getLocalHost() you are not guaranteed to get a particular interface, ie. you could receive the loopback (127) interface or a connected one.
In order to ensure you always get an external interface, you should use the java.net.NetworkInterface class. The static getByName(String) class will give you the interface with the defined name (such as "eth0"). Then you can use the getInetAddresses() function to obtain the IP addresses (could be just one) bound to that interface.
NetworkInterface ni = NetworkInterface.getByName("eth1");
ni.getInetAddresses();
Check your /etc/host file. If you put 127.0.0.1 first, it will return this as result.
The correct way to get the ip address is to use NetworkInterface.getNetworkInterfaces() and run getInetAddresses() on each of them.
You can use the NetworkInterface.getNetworkInterfaces() method to retrieve an Enumeration of all of the network interfaces for your system.
For each of the NetworkInterface instances, you can then use the getInetAddresses() method to retrieve an Enumeration of all of the InetAddress instances associated with the network interface.
Finally, you can use the getHostAddress() method on each InetAddress instance to retrieve the IP address in textual form.
This is because you have a line in /etc/hosts like
127.0.0.1 localhost
you need to have
192.xxx.xxx.xxx localhost
Though please note that this would be very bad as to solve a code issue you should not modify linux config files. Not only is it not right (and risks breaking some other network aware apps on your linux box) it will also not work anywhere else (unless the admins of those boxes are also like minded).
javadoc for InetAddress.getLocalHost(); read "....an InetAddress representing the loopback address is returned." so it appears that the implementation of getLocalHost() is incorrect
on your UNIX and WIN boxes. The loopback address is nearly allways 127.0.0.1
Found this comment
"A host may have several IP addresses and other hosts may have to use different addresses to reach it. E.g. hosts on the intranet may have to use 192.168.0.100, but external machines may have to use 65.123.66.124. If you have a socket connection to another host you can call
Socket.getLocalAddress() to find out which local address is used for the socket."