一.概述
上一篇arp请求使用的是链路层的原始套接字。icmp封装在ip数据报里面，所以icmp请求可以直接使用网络层的原始套接字，即socket()第一个参数是PF_INET。如下：
1 sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP);
icmp报文不同的类型有不同的格式，我们以icmp回显请求和会显应答报文格式(即ping程序使用的报文类型)为例：
类型为8表示请求，为0表示应答。校验和要自己计算，标识符一般为程序的进程ID号。序号自定义，一般从1开始。选项数据里面可以放时间戳，用作计算ping一次的花费时间！
icmp报文结构定义在netinet/ip_icmp.h
1 struct icmp
2 {
3 u_int8_t icmp_type; /* type of message, see below */
4 u_int8_t icmp_code; /* type sub code */
5 u_int16_t icmp_cksum; /* ones complement checksum of struct */
6 union
7 {
8 u_char ih_pptr; /* ICMP_PARAMPROB */
9 struct in_addr ih_gwaddr; /* gateway address */
10 struct ih_idseq /* echo datagram */
11 {
12 u_int16_t icd_id;
13 u_int16_t icd_seq;
14 } ih_idseq;
15 u_int32_t ih_void;
16
17 /* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */
18 struct ih_pmtu
19 {
20 u_int16_t ipm_void;
21 u_int16_t ipm_nextmtu;
22 } ih_pmtu;
23
24 struct ih_rtradv
25 {
26 u_int8_t irt_num_addrs;
27 u_int8_t irt_wpa;
28 u_int16_t irt_lifetime;
29 } ih_rtradv;
30 } icmp_hun;
31 #define icmp_pptr icmp_hun.ih_pptr
32 #define icmp_gwaddr icmp_hun.ih_gwaddr
33 #define icmp_id icmp_hun.ih_idseq.icd_id
34 #define icmp_seq icmp_hun.ih_idseq.icd_seq
35 #define icmp_void icmp_hun.ih_void
36 #define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void
37 #define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu
38 #define icmp_num_addrs icmp_hun.ih_rtradv.irt_num_addrs
39 #define icmp_wpa icmp_hun.ih_rtradv.irt_wpa
40 #define icmp_lifetime icmp_hun.ih_rtradv.irt_lifetime
41 union
42 {
43 struct
44 {
45 u_int32_t its_otime;
46 u_int32_t its_rtime;
47 u_int32_t its_ttime;
48 } id_ts;
49 struct
50 {
51 struct ip idi_ip;
52 /* options and then 64 bits of data */
53 } id_ip;
54 struct icmp_ra_addr id_radv;
55 u_int32_t id_mask;
56 u_int8_t id_data[1];
57 } icmp_dun;
58 #define icmp_otime icmp_dun.id_ts.its_otime
59 #define icmp_rtime icmp_dun.id_ts.its_rtime
60 #define icmp_ttime icmp_dun.id_ts.its_ttime
61 #define icmp_ip icmp_dun.id_ip.idi_ip
62 #define icmp_radv icmp_dun.id_radv
63 #define icmp_mask icmp_dun.id_mask
64 #define icmp_data icmp_dun.id_data
65 };
二.icmp请求代码
1 /**
2 * @file icmp_request.c
3 */
4
5 #include <stdio.h>
6 #include <stdlib.h>
7 #include <string.h>
8 #include <unistd.h>
9 #include <sys/socket.h>
10 #include <arpa/inet.h>
11 #include <netinet/in.h>
12 #include <netinet/ip_icmp.h>
13 #include <sys/time.h>
14
15 /* icmp报文长度 */
16 #define ICMP_PACKET_LEN sizeof(struct icmp)
17
18 void err_exit(const char *err_msg)
19 {
20 perror(err_msg);
21 exit(1);
22 }
23
24 /* 校验和 */
25 unsigned short check_sum(unsigned short *addr, int len)
26 {
27 int nleft = len;
28 int sum = 0;
29 unsigned short *w = addr;
30 unsigned short answer = 0;
31
32 while(nleft > 1)
33 {
34 sum += *w++;
35 nleft -= 2;
36 }
37 if(nleft == 1)
38 {
39 *(unsigned char *)(&answer) = *(unsigned char *)w;
40 sum += answer;
41 }
42
43 sum = (sum >> 16) + (sum & 0xffff);
44 sum += (sum >> 16);
45 answer = ~sum;
46
47 return answer;
48 }
49
50 /* 填充icmp报文 */
51 struct icmp *fill_icmp_packet(int icmp_type, int icmp_sequ)
52 {
53 struct icmp *icmp_packet;
54
55 icmp_packet = (struct icmp *)malloc(ICMP_PACKET_LEN);
56 icmp_packet->icmp_type = icmp_type;
57 icmp_packet->icmp_code = 0;
58 icmp_packet->icmp_cksum = 0;
59 icmp_packet->icmp_id = htons(getpid());
60 icmp_packet->icmp_seq = htons(icmp_sequ);
61 /* 发送时间 */
62 gettimeofday((struct timeval *)icmp_packet->icmp_data, NULL);
63 /* 校验和 */
64 icmp_packet->icmp_cksum = check_sum((unsigned short *)icmp_packet, ICMP_PACKET_LEN);
65
66 return icmp_packet;
67 }
68
69 /* 发送icmp请求 */
70 void icmp_request(const char *dst_ip, int icmp_type, int icmp_sequ)
71 {
72 struct sockaddr_in dst_addr;
73 struct icmp *icmp_packet;
74 int sockfd, ret_len;
75 char buf[ICMP_PACKET_LEN];
76
77 /* 请求的地址 */
78 bzero(&dst_addr, sizeof(struct sockaddr_in));
79 dst_addr.sin_family = AF_INET;
80 dst_addr.sin_addr.s_addr = inet_addr(dst_ip);
81
82 if ((sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1)
83 err_exit("sockfd()");
84
85 /* icmp包 */
86 icmp_packet = fill_icmp_packet(icmp_type, icmp_sequ);
87 memcpy(buf, icmp_packet, ICMP_PACKET_LEN);
88
89 /* 发送请求 */
90 ret_len = sendto(sockfd, buf, ICMP_PACKET_LEN, 0, (struct sockaddr *)&dst_addr, sizeof(struct sockaddr_in));
91 if (ret_len > 0)
92 printf("sendto() ok!!!\n");
93
94 close(sockfd);
95 }
96
97 int main(int argc, const char *argv[])
98 {
99 if (argc != 2)
100 {
101 printf("usage:%s dst_ip\n", argv[0]);
102 exit(1);
103 }
104
105 /* 发送icmp请求 */
106 icmp_request(argv[1], 8, 1);
107
108 return 0;
109 }
流程：命令行接收icmp请求的目标IP，106行发送请求，指定icmp类型是8，序列号是1。然后通过目标IP地址创建网络地址结构，接着创建ICMP类型的原始套接字，填充icmp报文，并把发送时间填到icmp的数据结构。
三.icmp接收代码
1 /**
2 * @file icmp_recv.c
3 */
4
5 #include <stdio.h>
6 #include <stdlib.h>
7 #include <string.h>
8 #include <unistd.h>
9 #include <sys/time.h>
10 #include <sys/socket.h>
11 #include <arpa/inet.h>
12 #include <netinet/in.h>
13 #include <netinet/ip.h>
14 #include <netinet/ip_icmp.h>
15
16 /* IP首部长度 */
17 #define IP_HEADER_LEN sizeof(struct ip)
18 /* icmp报文长度 */
19 #define ICMP_PACKET_LEN sizeof(struct icmp)
20 /* IP + ICMP长度 */
21 #define IP_ICMP_PACKET_LEN IP_HEADER_LEN + ICMP_PACKET_LEN
22
23 void err_exit(const char *err_msg)
24 {
25 perror(err_msg);
26 exit(1);
27 }
28
29 /* 计算发送时间与接收时间的毫秒差 */
30 float time_interval(struct timeval *recv_time, struct timeval *send_time)
31 {
32 float msec = 0;
33
34 /* 如果接收的时间微妙小于发送的微妙 */
35 if (recv_time->tv_usec < send_time->tv_usec)
36 {
37 recv_time->tv_sec -= 1;
38 recv_time->tv_usec += 1000000;
39 }
40 msec = (recv_time->tv_sec - send_time->tv_sec) * 1000.0 + (recv_time->tv_usec - send_time->tv_usec) / 1000.0;
41
42 return msec;
43 }
44
45 int main(void)
46 {
47 struct ip *ip_header;
48 struct icmp *icmp_packet;
49 char buf[IP_ICMP_PACKET_LEN];
50 struct timeval *recv_timeval, *send_timeval;
51 int sockfd, ret_len;
52
53 if ((sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1)
54 err_exit("sockfd()");
55
56 recv_timeval = malloc(sizeof(struct timeval));
57 while (1)
58 {
59 ret_len = recv(sockfd, buf, IP_ICMP_PACKET_LEN, 0);
60 if (ret_len > 0)
61 {
62 /* 接收时间 */
63 gettimeofday(recv_timeval, NULL);
64 /* 取出ip首部 */
65 /* 取出icmp报文 */
66 ip_header = (struct ip *)buf;
67 icmp_packet = (struct icmp *)(buf + IP_HEADER_LEN);
68 /* 取出发送时间 */
69 send_timeval = (struct timeval *)icmp_packet->icmp_data;
70 printf("===============================\n");
71 printf("from ip:%s\n", inet_ntoa(ip_header->ip_src));
72 printf("icmp_type:%d\n", icmp_packet->icmp_type);
73 printf("icmp_code:%d\n", icmp_packet->icmp_code);
74 printf("time interval:%.3fms\n", time_interval(recv_timeval, send_timeval));
75 }
76 }
77
78 free(recv_timeval);
79 close(sockfd);
80 return 0;
81 }
流程：创建ICMP类型的原始套接字后直接接收。首先获取接收时间，然后依次取出ip首部，icmp报文，再取出icmp的请求时间。从ip首部获取源ip地址，从icmp报文获取该报文的类型，代码号，通过发送时间和接收时间计算毫秒差！
四.实验
1.打开wireshark一起观察。以root运行icmp_recv，再运行icmp_request
可以看到icmp的类型是0，代码也是0。响应时间跟我们的程序差不多。
2.现在我们请求一个不可达的ip地址
主机不可达时，返回的icmp报文类型是3，代码是1。报文结构不同，取出的发送时间是不正常的，所以这里计算的时间间隔也不正常。wireshark里面的结果是，本机自动广播了一个arp请求，但没有机器回答本机。
部分icmp类型：
