生活随笔
收集整理的這篇文章主要介紹了
winpcap编程 解析数据包
小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.
WinPcap和Libpcap的最強(qiáng)大的特性之一，是擁有過濾數(shù)據(jù)包的引擎。 它提供了有效的方法去獲取網(wǎng)絡(luò)中的某些數(shù)據(jù)包，這也是WinPcap捕獲機(jī)制中的一個(gè)組成部分。 用來過濾數(shù)據(jù)包的函數(shù)是?pcap_compile()?和pcap_setfilter()?。
pcap_compile()?它將一個(gè)高層的布爾過濾表達(dá)式編譯成一個(gè)能夠被過濾引擎所解釋的低層的字節(jié)碼。有關(guān)布爾過濾表達(dá)式的語法可以參見?Filtering expression syntax?這一節(jié)的內(nèi)容。
pcap_setfilter()?將一個(gè)過濾器與內(nèi)核捕獲會(huì)話向關(guān)聯(lián)。當(dāng)?pcap_setfilter()?被調(diào)用時(shí)，這個(gè)過濾器將被應(yīng)用到來自網(wǎng)絡(luò)的所有數(shù)據(jù)包，并且，所有的符合要求的數(shù)據(jù)包 (即那些經(jīng)過過濾器以后，布爾表達(dá)式為真的包) ，將會(huì)立即復(fù)制給應(yīng)用程序。
現(xiàn)在，我們可以捕捉并過濾網(wǎng)絡(luò)流量了，那就讓我們學(xué)以致用，來做一個(gè)簡單使用的程序吧。
在本講中，我們將會(huì)利用上一講的一些代碼，來建立一個(gè)更實(shí)用的程序。 本程序的主要目標(biāo)是展示如何解析所捕獲的數(shù)據(jù)包的協(xié)議首部。這個(gè)程序可以稱為UDPdump，打印一些網(wǎng)絡(luò)上傳輸?shù)腢DP數(shù)據(jù)的信息。
我們選擇分析和現(xiàn)實(shí)UDP協(xié)議而不是TCP等其它協(xié)議，是因?yàn)樗绕渌膮f(xié)議更簡單，作為一個(gè)入門程序范例，是很不錯(cuò)的選擇。讓我們看看代碼：
?
[cpp]?view plaincopy
#include?"pcap.h"??????typedef?struct?ip_address{??????u_char?byte1;??????u_char?byte2;??????u_char?byte3;??????u_char?byte4;??}ip_address;??????typedef?struct?ip_header{??????u_char??ver_ihl;??????????????u_char??tos;??????????????????u_short?tlen;?????????????????u_short?identification;???????u_short?flags_fo;?????????????u_char??ttl;??????????????????u_char??proto;????????????????u_short?crc;??????????????????ip_address??saddr;????????????ip_address??daddr;????????????u_int???op_pad;???????????}ip_header;??????typedef?struct?udp_header{??????u_short?sport;????????????????u_short?dport;????????????????u_short?len;??????????????????u_short?crc;??????????????}udp_header;??????void?packet_handler(u_char?*param,?const?struct?pcap_pkthdr?*header,?const?u_char?*pkt_data);??????int?main()??{??pcap_if_t?*alldevs;??pcap_if_t?*d;??int?inum;??int?i=0;??pcap_t?*adhandle;??char?errbuf[PCAP_ERRBUF_SIZE];??u_int?netmask;??char?packet_filter[]?=?"ip?and?udp";??struct?bpf_program?fcode;??????????????if?(pcap_findalldevs_ex(PCAP_SRC_IF_STRING,?NULL,?&alldevs,?errbuf)?==?-1)??????{??????????fprintf(stderr,"Error?in?pcap_findalldevs:?%s/n",?errbuf);??????????exit(1);??????}??????????????????for(d=alldevs;?d;?d=d->next)??????{??????????printf("%d.?%s",?++i,?d->name);??????????if?(d->description)??????????????printf("?(%s)/n",?d->description);??????????else??????????????printf("?(No?description?available)/n");??????}????????if(i==0)??????{??????????printf("/nNo?interfaces?found!?Make?sure?WinPcap?is?installed./n");??????????return?-1;??????}????????????printf("Enter?the?interface?number?(1-%d):",i);??????scanf("%d",?&inum);????????????if(inum?<?1?||?inum?>?i)??????{??????????printf("/nInterface?number?out?of?range./n");????????????????????pcap_freealldevs(alldevs);??????????return?-1;??????}??????????????for(d=alldevs,?i=0;?i<?inum-1?;d=d->next,?i++);??????????????????if?(?(adhandle=?pcap_open(d->name,?????????????????????????????????65536,??????????????????????????????????????????????????????????????????????????????PCAP_OPENFLAG_PROMISCUOUS,????????????????????????????????????????1000,?????????????????????????????????????NULL,?????????????????????????????????????errbuf????????????????????????????????????)?)?==?NULL)??????{??????????fprintf(stderr,"/nUnable?to?open?the?adapter.?%s?is?not?supported?by?WinPcap/n");????????????????????pcap_freealldevs(alldevs);??????????return?-1;??????}??????????????????if(pcap_datalink(adhandle)?!=?DLT_EN10MB)??????{??????????fprintf(stderr,"/nThis?program?works?only?on?Ethernet?networks./n");????????????????????pcap_freealldevs(alldevs);??????????return?-1;??????}????????????if(d->addresses?!=?NULL)????????????????????netmask=((struct?sockaddr_in?*)(d->addresses->netmask))->sin_addr.S_un.S_addr;??????else????????????????????netmask=0xffffff;?????????????????if?(pcap_compile(adhandle,?&fcode,?packet_filter,?1,?netmask)?<0?)??????{??????????fprintf(stderr,"/nUnable?to?compile?the?packet?filter.?Check?the?syntax./n");????????????????????pcap_freealldevs(alldevs);??????????return?-1;??????}??????????????????if?(pcap_setfilter(adhandle,?&fcode)<0)??????{??????????fprintf(stderr,"/nError?setting?the?filter./n");????????????????????pcap_freealldevs(alldevs);??????????return?-1;??????}????????????printf("/nlistening?on?%s.../n",?d->description);??????????????????pcap_freealldevs(alldevs);??????????????????pcap_loop(adhandle,?0,?packet_handler,?NULL);????????????return?0;??}??????void?packet_handler(u_char?*param,?const?struct?pcap_pkthdr?*header,?const?u_char?*pkt_data)??{??????struct?tm?*ltime;??????char?timestr[16];??????ip_header?*ih;??????udp_header?*uh;??????u_int?ip_len;??????u_short?sport,dport;??????time_t?local_tv_sec;??????????????local_tv_sec?=?header->ts.tv_sec;??????ltime=localtime(&local_tv_sec);??????strftime(?timestr,?sizeof?timestr,?"%H:%M:%S",?ltime);??????????????printf("%s.%.6d?len:%d?",?timestr,?header->ts.tv_usec,?header->len);??????????????ih?=?(ip_header?*)?(pkt_data?+??????????14);???????????????ip_len?=?(ih->ver_ihl?&?0xf)?*?4;??????uh?=?(udp_header?*)?((u_char*)ih?+?ip_len);??????????????sport?=?ntohs(?uh->sport?);??????dport?=?ntohs(?uh->dport?);??????????????printf("%d.%d.%d.%d.%d?->?%d.%d.%d.%d.%d/n",??????????ih->saddr.byte1,??????????ih->saddr.byte2,??????????ih->saddr.byte3,??????????ih->saddr.byte4,??????????sport,??????????ih->daddr.byte1,??????????ih->daddr.byte2,??????????ih->daddr.byte3,??????????ih->daddr.byte4,??????????dport);??}?? ?
?
轉(zhuǎn)載于:https://www.cnblogs.com/jiangyea/p/3530149.html
總結(jié)
以上是生活随笔為你收集整理的winpcap编程 解析数据包的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。
