[Java for Android App Development] vlad020791:
I am trying to develop a sniffer in android using VpnService. I modified the ToyVpn example so that i am capable to read the ip packets from the ParcelFileDescriptor. For every packet I open a Socket with the dest ip and port and send the payload(whitout IP or TCP header) and read the response from the server.

I use this code:

// We keep forwarding packets till something goes wrong.
while (vpnInterface != null && vpnInterface.getFileDescriptor() != null
&& vpnInterface.getFileDescriptor().valid()) {

packet.clear();

// Read the outgoing packet from the input stream.
final byte[] data = packet.array();

int length = in.read(data);

//for geting unsigned int from byte
int[] d = new int[data.length];

if (length > 0) {
packet.limit(length);
StringBuilder sb = new StringBuilder("");
for (int i = 0; i < length; i++) {
d[i] = data[i] & 0xFF;
sb.append(Integer.toHexString(d[i])+" ");
}
Log.i("packet", sb.toString());
Socket socket = SocketChannel.open().socket();
this.protect(socket);

//connect to output ip and port
socket.connect(new InetSocketAddress(d[16] + "." + d[17] + "."
+ d[18] + "." + d[19], (d[22] * 256) + d[23]));

DataOutputStream dOut = new DataOutputStream(
socket.getOutputStream());
DataInputStream dIn = new DataInputStream(
socket.getInputStream());

dOut.write(data, 40, length - 40);

//read data from the socket
length = dIn.read(data);

if (length > 0) {
sb = new StringBuilder("");
for (int i = 0; i <length; i++) {
d[i] = data[i] & 0xFF;
sb.append(Integer.toHexString(d[i])+" ");
}
Log.w("lungime", length+"");
Log.i("response", sb.toString());

//write data to virtual interface
out.write(data, 0, length);
}
socket.close();
}

Thread.sleep(5);
}

The Log looks like this:

12-04 15:37:29.891: I/packet(7029): 45 0 0 3c a3 8b 40 0 40 6 b8 35 a 0 0 2 ad c2 27 37 88 c3 0 50 d4 8f 3b 1b 0 0 0 0 a0 2 35 20 f9 ce 0 0 2 4 5 50 4 2 8 a 2 1c 9f a0 0 0 0 0 1 3 3 6
12-04 15:37:29.986: W/lungime(7029): 1068
12-04 15:37:29.991: I/response(7029): 48 54 54 50 2f 31 2e 30 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 d a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 d a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 39 32 35 d a 44 61 74 65 3a 20 57 65 64 2c 20 30 34 20 44 65 63 20 32 30 31 33 20 31 34 3a 33 36 3a 31 33 20 47 4d 54 d a 53 65 72 76 65 72 3a 20 47 46 45 2f 32 2e 30 d a d a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e a 20 20 3c 73 74 79 6c 65 3e a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d a 20 20 3c 2f 73 74 79 6c 65 3e a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 69 6d 67 20 73 72 63 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 6c 6f 67 6f 5f 73 6d 2e 67 69 66 20 61 6c 74 3d 47 6f 6f 67 6c 65 3e 3c 2f 61 3e a 20 20 3c 70 3e 3c 62 3e 34 30 30 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e a 20 20 3c 70 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 20 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e a

The first is really an IP packet but the problem is that I don't know what this response means. I was expecting to receive a IP packet,too. This response that you see above, I write it to the OutputStreamReader coresponding to the virtual interface and it apears to me in the VPN Status that I received packets. All this packets are from browser trying to access the google page but that packets which I write to Virtual interface maybe are thrown because the page does not open.

In adb shell netstat I get this:

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 1 0 10.0.0.2:35011 173.194.39.55:80 SYN_SENT
tcp 1 0 10.0.0.2:35010 173.194.39.55:80 SYN_SENT
tcp6 0 1 ::ffff:172.21.201.226:39772 ::ffff:173.194.39.39:80 CLOSE_WAIT
tcp6 0 0 ::ffff:172.21.201.226:45095 ::ffff:173.194.39.55:443 ESTABLISHED
tcp6 1 0 ::ffff:10.0.0.2:38484 ::ffff:173.194.70.95:443 SYN_SENT
tcp6 0 0 ::ffff:172.21.201.226:59836 ::ffff:173.194.70.188:5228 ESTABLISHED
tcp6 1 0 ::ffff:172.21.201.226:50164 ::ffff:173.194.70.95:443 SYN_SENT
tcp6 0 0 ::ffff:172.21.201.226:55260 ::ffff:54.228.207.7:5223 ESTABLISHED

So it seems that the SYN package was send but I receive nothing. If anybody could tell me what the received bytes means and how to write them properly in the virtual interface I will be deeply grateful.