feat(packet_sniffer): replace port scanner with packet sniffer

Captures network packets, extracts source/destination IPs, protocol type, and
ports. Masks IPs when enabled and logs details with protocol information.

src/cli/packet_sniffer_cli.cpp

@@ -0,0 +1,30 @@
+#include "packet_sniffer_cli.hpp"
+#include <boost/program_options/value_semantic.hpp>
+
+PacketSnifferCli::PacketSnifferCli()
+    : CliBase("Packet Sniffer Options")
+    , ip_("")
+{
+}
+
+void PacketSnifferCli::setupOptions()
+{
+    // clang-format off
+    desc_.add_options()
+        ("help,h",  "Show help")
+        ("ip,H",    withDefault(ip_, "<IP>"), "Local IPv4 to sniff (e.g. 192.168.1.42)")
+        ("mask,m",  boost::program_options::value<bool>()->default_value(false)->implicit_value(true),
+                    "Mask IP addresses in output (demo)");
+    // clang-format on
+}
+
+std::string PacketSnifferCli::getIp() const
+{
+    return vm_.at("ip").as<std::string>();
+}
+
+bool PacketSnifferCli::isMaskEnabled() const
+{
+    const auto it = vm_.find("mask");
+    return (it != vm_.end()) ? it->second.as<bool>() : false;
+}

src/cli/packet_sniffer_cli.hpp

@@ -0,0 +1,19 @@
+#pragma once
+#include "cli_base.hpp"
+#include "option_utils.hpp"
+#include <string>
+
+class PacketSnifferCli : public CliBase, protected OptionUtils
+{
+  public:
+    PacketSnifferCli();
+
+    std::string getIp() const;
+    bool isMaskEnabled() const;
+
+  protected:
+    void setupOptions() override;
+
+  private:
+    std::string ip_;
+};

src/cli/portscan_cli.cpp

@@ -1,28 +0,0 @@
-#include "portscan_cli.hpp"
-#include <boost/program_options/value_semantic.hpp>
-#include <cassert>
-
-PortScanCli::PortScanCli()
-    : CliBase("Port Scanner Options")
-{
-}
-
-void PortScanCli::setupOptions()
-{
-    // clang-format off
-    desc_.add_options()
-        ("help,h",      "Show help")
-        ("ip,H",        withDefault(ip_, "<IPv4>"),      "Base IPv4 inside your LAN (e.g. 10.0.1.42)")
-        ("prefix,p",    withDefault(prefix_, "<0..32>"), "CIDR prefix length (e.g. 24)");
-    // clang-format on
-}
-
-int PortScanCli::getPrefix() const
-{
-    return vm_.at("prefix").as<int>();
-}
-
-std::string PortScanCli::getBaseIp() const
-{
-    return vm_.at("ip").as<std::string>();
-}

src/cli/portscan_cli.hpp

@@ -1,21 +0,0 @@
-#pragma once
-
-#include "cli_base.hpp"
-#include "option_utils.hpp"
-#include <string>
-
-class PortScanCli : public CliBase, protected OptionUtils
-{
-  public:
-    PortScanCli();
-
-    int getPrefix() const;
-    std::string getBaseIp() const;
-
-  protected:
-    void setupOptions() override;
-
-  private:
-    int prefix_{24};
-    std::string ip_{"10.0.1.0"};
-};

src/core/local_ping_scanner.cpp

@@ -1,103 +0,0 @@
-#include "local_ping_scanner.hpp"
-#include "logger.hpp"
-#include <Poco/Net/ICMPClient.h>
-#include <boost/asio/ip/address_v4.hpp>
-#include <stdexcept>
-
-LocalPingScanner::LocalPingScanner(
-    const std::string &baseIp, int prefixLen, int timeoutMs
-)
-    : baseIp_(baseIp)
-    , prefixLen_(prefixLen)
-    , timeoutMs_(timeoutMs)
-{
-    if (prefixLen_ < 0 || prefixLen_ > 32) {
-        Logger::error("Invalid prefix length in LocalPingScanner constructor");
-        throw std::runtime_error("Bad prefix length");
-    }
-    if (timeoutMs_ <= 0) {
-        timeoutMs_ = 2000;
-    }
-}
-
-const std::vector<std::string> &LocalPingScanner::alive() const
-{
-    return alive_;
-}
-
-uint32_t LocalPingScanner::ipToU32(const std::string &ip)
-{
-    using namespace boost::asio::ip;
-    return static_cast<uint32_t>(make_address_v4(ip).to_uint());
-}
-
-std::string LocalPingScanner::u32ToIp(uint32_t v)
-{
-    using namespace boost::asio::ip;
-    return address_v4(v).to_string();
-}
-
-bool LocalPingScanner::pingHost(const std::string &ip) const
-{
-    try {
-        return Poco::Net::ICMPClient::pingIPv4(
-                   ip,
-                   /*repeat=*/1,
-                   /*dataSize=*/48,
-                   /*ttl=*/64,
-                   /*timeout=*/timeoutMs_
-               )
-               > 0;
-    } catch (const std::exception &ex) {
-        Logger::error(
-            std::string("Ping failed for host ") + ip + ": " + ex.what()
-        );
-        return false;
-    } catch (...) {
-        Logger::fatal(std::string("Unknown error pinging host ") + ip);
-        return false;
-    }
-}
-
-void LocalPingScanner::runImpl()
-{
-    alive_.clear();
-
-    const uint32_t base = ipToU32(baseIp_);
-    const uint32_t mask =
-        (prefixLen_ == 0) ? 0u : (0xFFFFFFFFu << (32 - prefixLen_));
-    const uint32_t network = base & mask;
-    const uint32_t broadcast = network | (~mask);
-
-    // No hosts when prefix is too tight (e.g., /32).
-    if (broadcast - network <= 2) {
-        return;
-    }
-
-    const std::string selfIp = u32ToIp(base);
-
-    for (uint32_t v = network + 1; v < broadcast; ++v) {
-        const std::string ipStr = u32ToIp(v);
-
-        if (ipStr == selfIp) {
-            continue;
-        }
-
-        if (pingHost(ipStr)) {
-            alive_.push_back(ipStr);
-        }
-    }
-}
-
-void LocalPingScanner::run()
-{
-    try {
-        runImpl();
-    } catch (const std::exception &ex) {
-        Logger::error(
-            std::string("Exception in LocalPingScanner::run: ") + ex.what()
-        );
-    } catch (...) {
-        Logger::fatal("Unknown exception in LocalPingScanner::run");
-    }
-}

src/core/local_ping_scanner.hpp

@@ -1,26 +0,0 @@
-#pragma once
-#include <cstdint>
-#include <string>
-#include <vector>
-
-class LocalPingScanner
-{
-  public:
-    LocalPingScanner(
-        const std::string &baseIp, int prefixLen, int timeoutMs = 2000
-    );
-
-    void run(); // blocking scan over subnet
-    const std::vector<std::string> &alive() const;
-
-  private:
-    static std::string u32ToIp(uint32_t v);
-    static uint32_t ipToU32(const std::string &ip);
-    bool pingHost(const std::string &ip) const;
-    void runImpl();
-
-    std::string baseIp_;
-    int prefixLen_;
-    int timeoutMs_;
-    std::vector<std::string> alive_;
-};

src/core/port_scanner.cpp

@@ -1,126 +0,0 @@
-#include "port_scanner.hpp"
-#include "logger.hpp"
-#include <algorithm>
-
-PortScanner::PortScanner(std::string ip, int timeoutMs)
-    : ip_(std::move(ip))
-    , timeoutMs_(timeoutMs)
-{
-    if (timeoutMs_ <= 0) {
-        timeoutMs_ = 250;
-    }
-}
-
-PortScanner::Probe::Probe(IoContext &io, uint16_t p)
-    : port(p)
-    , socket(io)
-    , timer(io)
-{
-}
-
-const std::vector<uint16_t> &PortScanner::openPorts() const
-{
-    return openPorts_;
-}
-
-void PortScanner::run()
-{
-    openPorts_.clear();
-    nextPort_ = kFirstPort;
-    outstanding_ = 0;
-    active_.clear();
-
-    while (outstanding_ < kMaxConcurrency && nextPort_ <= kLastPort) {
-        startNext();
-    }
-
-    io_.run();
-}
-
-void PortScanner::startNext()
-{
-    if (nextPort_ > kLastPort) {
-        return;
-    }
-
-    const uint16_t port = static_cast<uint16_t>(nextPort_);
-    nextPort_ += 1;
-
-    startProbe(port);
-}
-
-void PortScanner::startProbe(uint16_t port)
-{
-    // Lifetime of Probe is managed in 'active_' until probe finishes.
-    auto prPtr = std::make_unique<Probe>(io_, port);
-    Probe *pr = prPtr.get();
-    active_.push_back(std::move(prPtr));
-
-    outstanding_ += 1;
-
-    {
-        using namespace boost::asio::ip;
-
-        TcpEndpoint ep(make_address_v4(ip_), port);
-
-        pr->timer.expires_after(std::chrono::milliseconds(timeoutMs_));
-
-        auto onTimer = [pr](const ErrorCode &ec) {
-            // Cancel socket on timeout; completion will run onConnect with
-            // ec=operation_aborted.
-            if (!ec) {
-                pr->socket.cancel();
-            }
-        };
-
-        auto onAsyncConnect = [this, pr](const ErrorCode &ec) {
-            onConnect(pr, ec);
-        };
-
-        pr->timer.async_wait(onTimer);
-        pr->socket.async_connect(ep, onAsyncConnect);
-    }
-}
-
-void PortScanner::onConnect(Probe *pr, const ErrorCode &ec)
-{
-    pr->timer.cancel();
-
-    // Open if connect succeeded; REFUSED means closed but host is alive.
-    if (!ec) {
-        openPorts_.push_back(pr->port);
-        Logger::info(std::string("Open port: ") + std::to_string(pr->port));
-    }
-
-    ErrorCode ignored;
-    pr->socket.close(ignored);
-
-    finishProbe(pr);
-}
-
-void PortScanner::finishProbe(Probe *pr)
-{
-    if (outstanding_ > 0) {
-        outstanding_ -= 1;
-    }
-
-    // Remove 'pr' from active_ (active_ size <= kMaxConcurrency, linear
-    // erase is fine).
-    auto it = std::find_if(
-        active_.begin(), active_.end(), [pr](const std::unique_ptr<Probe> &u) {
-            return u.get() == pr;
-        }
-    );
-    if (it != active_.end()) {
-        active_.erase(it);
-    }
-
-    if (nextPort_ <= kLastPort) {
-        startNext();
-    }
-
-    if (outstanding_ == 0 && nextPort_ > kLastPort) {
-        io_.stop();
-        return;
-    }
-}

src/core/port_scanner.hpp

@@ -1,43 +0,0 @@
-#pragma once
-#include "aliases.hpp"
-#include <cstdint>
-#include <memory>
-#include <string>
-#include <vector>
-
-class PortScanner
-{
-  public:
-    explicit PortScanner(std::string ip, int timeoutMs = 250);
-
-    void run(); // blocking scan
-    const std::vector<uint16_t> &openPorts() const;
-
-  private:
-    struct Probe {
-        uint16_t port{0};
-        TcpSocket socket;
-        SteadyTimer timer;
-
-        Probe(IoContext &io, uint16_t p);
-    };
-
-    void startNext();
-    void startProbe(uint16_t port);
-    void onConnect(Probe *pr, const ErrorCode &ec);
-    void finishProbe(Probe *pr);
-
-    // Fixed settings
-    static constexpr uint16_t kFirstPort = 1;
-    static constexpr uint16_t kLastPort = 65535;
-    static constexpr std::size_t kMaxConcurrency = 256;
-
-    // State
-    std::string ip_;
-    IoContext io_;
-    std::vector<uint16_t> openPorts_;
-    std::vector<std::unique_ptr<Probe>> active_; // <= kMaxConcurrency
-    uint32_t nextPort_{kFirstPort};
-    std::size_t outstanding_{0};
-    int timeoutMs_;
-};

src/core/sniffer.cpp

@@ -0,0 +1,135 @@
+#include "sniffer.hpp"
+#include "logger.hpp"
+#include <tins/tins.h>
+
+Sniffer::Sniffer(std::string localIp, bool maskIp)
+    : ip_(std::move(localIp))
+    , mask_(maskIp)
+{
+}
+
+int Sniffer::run()
+{
+    const auto ifaceName = resolveIfaceNameByIp(ip_);
+
+    Tins::SnifferConfiguration cfg;
+    cfg.set_promisc_mode(true);
+    cfg.set_immediate_mode(true);
+
+    Tins::Sniffer sniffer(ifaceName, cfg);
+
+    auto running = [this] { return !stop_.load(std::memory_order_relaxed); };
+
+    auto handler = [&](Tins::PDU &pdu) -> bool {
+        if (!running())
+            return false;
+
+        std::string src, dst;
+        const char *type = "OTHER";
+        uint16_t sport = 0, dport = 0;
+
+        if (auto *arp = pdu.find_pdu<Tins::ARP>()) {
+            src = arp->sender_ip_addr().to_string();
+            dst = arp->target_ip_addr().to_string();
+            type = "ARP";
+        } else if (auto *ip4 = pdu.find_pdu<Tins::IP>()) {
+            src = ip4->src_addr().to_string();
+            dst = ip4->dst_addr().to_string();
+
+            if (auto *tcp = pdu.find_pdu<Tins::TCP>()) {
+                type = "TCP";
+                sport = tcp->sport();
+                dport = tcp->dport();
+            } else if (auto *udp = pdu.find_pdu<Tins::UDP>()) {
+                type = "UDP";
+                sport = udp->sport();
+                dport = udp->dport();
+            } else if (pdu.find_pdu<Tins::ICMP>()) {
+                type = "ICMP";
+            } else {
+                type = "IP";
+            }
+        } else if (auto *ip6 = pdu.find_pdu<Tins::IPv6>()) {
+            src = ip6->src_addr().to_string();
+            dst = ip6->dst_addr().to_string();
+
+            if (auto *tcp = pdu.find_pdu<Tins::TCP>()) {
+                type = "TCP";
+                sport = tcp->sport();
+                dport = tcp->dport();
+            } else if (auto *udp = pdu.find_pdu<Tins::UDP>()) {
+                type = "UDP";
+                sport = udp->sport();
+                dport = udp->dport();
+            } else if (pdu.find_pdu<Tins::ICMPv6>()) {
+                type = "ICMPv6";
+            } else {
+                type = "IPv6";
+            }
+        } else {
+            Logger::info("(unknown src) -> (unknown dst) [OTHER]");
+            return running();
+        }
+
+        if (mask_) {
+            src = hideHalf(src);
+            dst = hideHalf(dst);
+        }
+
+        printLine(src, dst, type, sport, dport);
+        return running();
+    };
+
+    sniffer.sniff_loop(handler);
+    return 0;
+}
+
+void Sniffer::stop()
+{
+    stop_.store(true, std::memory_order_relaxed);
+}
+
+std::string Sniffer::hideHalf(const std::string &s) const
+{
+    if (s.empty()) {
+        return s;
+    }
+
+    const size_t n = s.size();
+    const size_t hide = n / 2;
+    const size_t keep = n - hide;
+    std::string out = s.substr(0, keep);
+    out.append(hide, '*');
+
+    return out;
+}
+
+std::string Sniffer::resolveIfaceNameByIp(const std::string &ip)
+{
+    const Tins::IPv4Address want(ip);
+    for (const auto &iface : Tins::NetworkInterface::all()) {
+        const auto info = iface.addresses(); // .ip_addr/.netmask/...
+        if (info.ip_addr == want) {
+            return iface.name();
+        }
+    }
+    throw std::runtime_error("Interface with IP " + ip + " not found");
+}
+
+void Sniffer::printLine(
+    const std::string &src,
+    const std::string &dst,
+    const char *type,
+    uint16_t sport,
+    uint16_t dport
+)
+{
+    if (sport || dport) {
+        Logger::info(
+            std::string(src) + ":" + std::to_string(sport) + " -> " + dst + ":"
+            + std::to_string(dport) + " [" + type + "]"
+        );
+    } else {
+        Logger::info(std::string(src) + " -> " + dst + " [" + type + "]");
+    }
+}

src/core/sniffer.hpp

@@ -0,0 +1,32 @@
+#pragma once
+#include <atomic>
+#include <cstdint>
+#include <string>
+
+class Sniffer
+{
+  public:
+    explicit Sniffer(std::string localIp, bool maskIp = false);
+
+    Sniffer(const Sniffer &) = delete;
+    Sniffer &operator=(const Sniffer &) = delete;
+
+    std::string hideHalf(const std::string &s) const;
+
+    int run();
+    void stop();
+
+  private:
+    static std::string resolveIfaceNameByIp(const std::string &ip);
+    static void printLine(
+        const std::string &src,
+        const std::string &dst,
+        const char *type,
+        uint16_t sport = 0,
+        uint16_t dport = 0
+    );
+
+    std::string ip_;
+    std::atomic<bool> stop_{false};
+    bool mask_{false};
+};

src/main.cpp

@@ -1,61 +1,26 @@
-#include "local_ping_scanner.hpp"
 #include "logger.hpp"
-#include "port_scanner.hpp"
-#include "portscan_cli.hpp"
-#include <string>
+#include "packet_sniffer_cli.hpp"
+#include "sniffer.hpp"
+#include <exception>
 
-int main(int argc, char **argv)
+int main(int argc, char *argv[])
 {
     Logger::init(true);
-
-    PortScanCli cli;
-    cli.parse(argc, argv);
-    if (cli.isHelp()) {
-        cli.printHelp();
-        return 0;
-    }
-
-    const std::string baseIp = cli.getBaseIp();
-
-    const int prefix = cli.getPrefix();
-    if (prefix < 0 || prefix > 32) {
-        Logger::fatal("Prefix must be in range 0..32\n");
-        return 2;
-    }
-
-    LocalPingScanner scanner(baseIp, prefix);
-    Logger::info(std::format("Scanning subnet: {}/{}", baseIp, prefix));
-
-    scanner.run();
-
-    const auto &alive = scanner.alive();
-    if (alive.empty()) {
-        Logger::info("No alive hosts found.\n");
-        return 0;
-    }
-
-    std::cout << "Alive hosts:\n";
-    for (const auto &ip : alive) {
-        std::cout << "  " << ip << "\n";
-    }
-
-    // For each alive host, run full TCP port scan
-    for (const auto &ip : alive) {
-        std::cout << "Scanning ports on " << ip << " ...\n";
-
-        PortScanner ps(ip);
-        ps.run();
-
-        const auto &open = ps.openPorts();
-        if (open.empty()) {
-            std::cout << "  No open TCP ports found on " << ip << "\n";
-        } else {
-            std::cout << "  Open ports on " << ip << ":\n";
-            for (uint16_t port : open) {
-                std::cout << "    " << port << "\n";
-            }
+    try {
+        PacketSnifferCli cli;
+        cli.parse(argc, argv);
+        if (cli.isHelp()) {
+            cli.printHelp();
+            return 0;
         }
-    }
 
-    return 0;
+        Sniffer sniffer(cli.getIp(), cli.isMaskEnabled());
+        return sniffer.run();
+    } catch (const std::exception &ex) {
+        Logger::fatal(ex.what());
+        return 1;
+    } catch (...) {
+        Logger::fatal("unknown error");
+        return 1;
+    }
 }

xmake.lua

@@ -10,18 +10,12 @@ add_requires("cmake::Boost", {
     },
 })
 
-add_requires("cmake::Poco", {
-    alias = "poco",
-    system = true,
-    configs = {
-        components = { "Net", "Foundation" },
-    },
-})
+add_requires("cmake::libtins", { alias = "libtins", system = true })
 
-target "port_scanner"
+target "packet_sniffer"
 do
     set_kind "binary"
     add_files("src/main.cpp", "src/cli/*.cpp", "src/common/*.cpp", "src/core/*.cpp")
     add_includedirs("src", "src/cli", "src/common", "src/core", { public = true })
-    add_packages("boost", "poco")
+    add_packages("boost", "libtins")
 end