/*
Based on my neped-libnet source, just figures out what boxens in your lan run IP stack and are in the same subnet with you..

to compile paste this into your Makefile (and you will need libnet/libpcap of course):
all:
  gcc `libnet-config --defines` arp-ping.c -o arp-ping -lnet -lpcap
clean:
  rm -f arp-ping

Cheers 
fygrave@tigerteam.net

*/

#include <libnet.h>
#include <pcap.h>
#ifdef __linux__
#include <net/ethernet.h>
#endif
#include <signal.h>

void usage(char *myname) {
  
  fprintf(stderr,"Usage: %s interface\n",myname);
  exit(1);
}

char *
hwaddr (u_char * s)
{
  static char buf[30];
  sprintf (buf, "%02X:%02X:%02X:%02X:%02X:%02X", s[0], s[1], s[2], s[3], s[4], s[5]);
  return buf;
}

char * 
inetaddr ( u_int32_t ip ) 
{
  struct in_addr in;
  in.s_addr = ip;
  return inet_ntoa(in);
}

/*
 * libnet stuff seemed buggy to me that's why I have these..
 * 
 */

u_long get_ipaddr(char *iface) {
int sd;
struct ifreq ifr;
struct in_addr inaddr;

  if((sd=socket(AF_INET,SOCK_DGRAM,0))<0) {
    perror("socket");
    return 0;
  }
  bcopy(iface,ifr.ifr_name,IFNAMSIZ);
  if(ioctl(sd,SIOCGIFADDR,&ifr)<0) {
    perror("ioctl(SIOCGIFADDR)");
    return 0;
  }
  bcopy(&ifr.ifr_addr.sa_data[2],&inaddr,sizeof(struct in_addr));
  close(sd);
  return inaddr.s_addr;
}



u_long get_ipmask(char *iface) {
int sd;
struct ifreq ifr;
struct in_addr inaddr;

  if((sd=socket(AF_INET,SOCK_DGRAM,0))<0) {
    perror("socket");
    return 0;
  }
  bcopy(iface,ifr.ifr_name,IFNAMSIZ);
  if(ioctl(sd,SIOCGIFNETMASK,&ifr)<0) {
    perror("ioctl(SIOCGIFADDR)");
    return 0;
  }
#ifdef __linux__
  bcopy(&ifr.ifr_netmask.sa_data[2],&inaddr,sizeof(struct in_addr));
#elif defined(__OpenBSD__)||defined(__FreeBSD__)||defined(__NetBSD__)
  bcopy(&ifr.ifr_addr.sa_data[2],&inaddr,sizeof(struct in_addr));
#endif
  close (sd);
  return inaddr.s_addr;

}


u_long get_ipbcast(char *iface) {
int sd;
struct ifreq ifr;
struct in_addr inaddr;

  if((sd=socket(AF_INET,SOCK_DGRAM,0))<0) {
    perror("socket");
    return 0;
  }
  bcopy(iface,ifr.ifr_name,IFNAMSIZ);
  if(ioctl(sd,SIOCGIFBRDADDR,&ifr)<0) {
    perror("ioctl(SIOCGIFADDR)");
    return 0;
  }
  bcopy(&ifr.ifr_broadaddr.sa_data[2],&inaddr,sizeof(struct in_addr));
  close(sd);
  return inaddr.s_addr;

}

pcap_t *open_device(char *device,u_long netmask) {

  pcap_t *pt;
  struct bpf_program fcode;
  char errbuf[PCAP_ERRBUF_SIZE];

  if((pt=pcap_open_live(device,1500,0,10,errbuf))==NULL) {
    fprintf(stderr,"pcap_open_live: %s\n",errbuf);
    return NULL;
  }
  if(pcap_compile(pt,&fcode,"arp[7] == 2",0,netmask)<0) {
    pcap_geterr(pt);
    return NULL;
  }
  if (pcap_setfilter(pt,&fcode)<0) {
    fprintf(stderr,"pcap_setfilter failed\n");
    return NULL;
  }
  
  return pt;
}

volatile int done;

struct etherarp_hdr
  {
    u_char dst_mac[6], src_mac[6], pkt_type[2];
    u_short hw_type, pro_type;
    u_char hw_len, pro_len;
    u_short arp_ope;
    u_char sender_eth[6];
    u_char sender_ip[4];
    u_char target_eth[6];
    u_char target_ip[4];
  };



void sig_alrm(int sig) {
  done=1;
}



int main(int argc,char **argv) {

int packsize;
int i,rs;
u_char *packet;
u_char zero_eaddr[6];
u_char bogus_eaddr[6]="\xff\xff\xff\xff\xff\xff";
struct etherarp_hdr *earphdr;
struct sockaddr_in sin;
struct ether_addr *eaddr;
char err_buf[LIBNET_ERRBUF_SIZE];
char *device;
char *devicehw;
struct libnet_link_int *lli;
u_long ipaddr,ipmask,ipbcast,ipremote;
u_long net_ip;
struct pcap_pkthdr pkthdr;
pcap_t *pt;
packsize=IP_MAXPACKET + ETH_H;


  if (geteuid () != 0) {
      perror ("Root required\n");
      exit (0);
    }

 

if (argc!=2) usage(argv[0]);
device=argv[1];
printf("---arp-ping (fygrave@tigerteam.net)---\n");
printf("Interface:\t%s\n",device);



libnet_init_packet(packsize,&packet);
if (packet==NULL) { 
  libnet_error(LIBNET_ERR_FATAL,"malloc failed\n");
  exit(1);
}


if((lli=libnet_open_link_interface(device,err_buf))==NULL) {
  fprintf(stderr,"failed to open device:%s\n",err_buf);
  exit(1);
}

if((eaddr=libnet_get_hwaddr(lli,device,err_buf))==NULL) {
  fprintf(stderr,"Can not get hw address: %s\n",err_buf);
  exit(1);
}
devicehw=hwaddr(eaddr->ether_addr_octet);
printf("HW address:\t%s\n",devicehw);

if((ipaddr=get_ipaddr(device))==0) {
  fprintf(stderr,"Can not get ip address\n");
  exit(1);
}


if((ipmask=get_ipmask(device))==0) {
  fprintf(stderr,"Can not get ip mask\n");
  exit(1);
}


if((ipbcast=get_ipbcast(device))==0) {
  fprintf(stderr,"Can not get ip broadcast\n");
  exit(1);
}

if ((pt=open_device(device,ipmask))==NULL) {
  fprintf(stderr,"can not open device for listening\n");
  exit(1);
}


printf("IP address:\t%s\n",inetaddr(ipaddr));
printf("IP netmask:\t%s\n",inetaddr(ipmask));
printf("IP broadcast:\t%s\n",inetaddr(ipbcast));

for (ipremote=ntohl((ipaddr & ipmask))+1;ipremote< ntohl(ipbcast);ipremote++) {
  net_ip=htonl(ipremote);
  bzero(zero_eaddr,6);
  libnet_build_ethernet(
    bogus_eaddr,
    eaddr->ether_addr_octet,
    ETHERTYPE_ARP,
    NULL,0,packet);
  libnet_build_arp(
    ARPOP_REQUEST,
    ETHERTYPE_IP,
    6,
    4,
    ARPOP_REQUEST,
    eaddr->ether_addr_octet,
    (u_char *)&ipaddr,
    zero_eaddr,
    (u_char *)&net_ip,
    NULL,0,packet+14);
  libnet_write_link_layer(lli,device,packet,42);
  printf("\rPing  %s .",inetaddr(net_ip));
  fflush(stdout);
  done=0;
  signal(SIGALRM,sig_alrm);
  alarm(1);
  while(!done) 
  {
    printf("\0x08-");
    fflush(stdout);
    if((earphdr=
      (struct etherarp_hdr*)pcap_next(pt,&pkthdr))!=NULL) {
      bcopy(earphdr->sender_ip,&net_ip,4);
      printf(" pong from %s/",inetaddr(net_ip));
      printf("%s\n",hwaddr(earphdr->src_mac));
      done=1;
    }
    printf("\x08|");
    fflush(stdout);
  }
  alarm(0);
}
libnet_destroy_packet(&packet);
libnet_close_link_interface(lli);
printf("\rDone                         \n");
exit(1);
}