[关闭]
@xunuo 2017-07-12T12:54:46.000000Z 字数 7627 阅读 1645

利用winpcap分析以太网协议

网络数据包分析

seq和ack应该有点问题
看不懂就对了？！

  1. #include "pcap.h"   
  2. #include<cstdlib>
  3. /*ip地址*/
  4. typedef struct ip_address
  5. {
  6.     u_char byte1;
  7.     u_char byte2;
  8.     u_char byte3;
  9.     u_char byte4;
  10. } ip_address;
  11. /*以太网协议头*/
  12. struct ether_header
  13. {
  14.     u_int8_t ether_dhost[6]; //目的Mac地址  
  15.     u_int8_t ether_shost[6]; //源Mac地址  
  16.     u_int16_t ether_type;    //协议类型  
  17. };
  18. /*IPv4协议头*/
  19. struct ip_header
  20. {
  21. #if defined(WORDS_BIENDIAN)  
  22.     u_int8_t    ip_version : 4, ip_header_length : 4;
  23. #else  
  24.     u_int8_t    ip_header_length : 4, ip_version : 4;
  25. #endif  
  26.     u_int8_t    ip_tos;
  27.     u_int16_t   ip_length;
  28.     u_int16_t   ip_id;
  29.     u_int16_t   ip_off;
  30.     u_int8_t    ip_ttl;
  31.     u_int8_t    ip_protocol;
  32.     u_int16_t   ip_checksum;
  33.     ip_address  saddr;          /*源地址(Source address)*/
  34.     ip_address  daddr;          /*目的地址(Destination address)*/
  35. };
  37. /*UDP协议头*/
  38. struct udphdr
  39. {
  40.     u_int16_t source_port; /*源地址端口*/
  41.     u_int16_t dest_port;    /*目的地址端口*/
  42.     u_int16_t len;     /*UDP长度*/
  43.     u_int16_t check;   /*UDP校验和*/
  44. };
  46. //TCP协议头  
  47. #define __LITTLE_ENDIAN_BITFIELD  
  48. struct tcphdr
  49. {
  50.     u_int16_t   source_port;         /*源地址端口*/
  51.     u_int16_t   dest_port;           /*目的地址端口*/
  52.     u_int32_t   seq;            /*序列号*/
  53.     u_int32_t   ack_seq;        /*确认序列号*/
  54.     u_int8_t    tcp_header_length : 4;
  55. #if defined(__LITTLE_ENDIAN_BITFIELD)  
  56.     u_int16_t res1 : 4,   /*保留*/
  57.         doff : 4,             /*偏移*/
  58.         fin : 1,              /*关闭连接标志*/
  59.         syn : 1,              /*请求连接标志*/
  60.         rst : 1,              /*重置连接标志*/
  61.         psh : 1,              /*接收方尽快将数据放到应用层标志*/
  62.         ack : 1,              /*确认序号标志*/
  63.         urg : 1,              /*紧急指针标志*/
  64.         ece : 1,              /*拥塞标志位*/
  65.         cwr : 1;              /*拥塞标志位*/
  66. #elif defined(__BIG_ENDIAN_BITFIELD)  
  67.     u_int16_t doff : 4,   /*偏移*/
  68.         res1 : 4,             /*保留*/
  69.         cwr : 1,              /*拥塞标志位*/
  70.         ece : 1,              /*拥塞标志位*/
  71.         urg : 1,              /*紧急指针标志*/
  72.         ack : 1,              /*确认序号标志*/
  73.         psh : 1,              /*接收方尽快将数据放到应用层标志*/
  74.         rst : 1,              /*重置连接标志*/
  75.         syn : 1,              /*请求连接标志*/
  76.         fin : 1;              /*关闭连接标志*/
  77. #else  
  78.     u_int16_t   flag;
  79. #endif   
  80.     u_int16_t   window;         /*滑动窗口大小*/
  81.     u_int16_t   check;          /*校验和*/
  82.     u_int16_t   urg_ptr;        /*紧急字段指针*/
  83. };
  84. //UDP协议分析  
  85. void udp_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  86. {
  87.     struct udphdr *udp_protocol;
  88.     u_int header_length = 0;
  89.     u_int16_t checksum;
  91.     udp_protocol = (struct udphdr *) packet_content;
  92.     checksum = ntohs(udp_protocol->check);
  94.     u_int16_t source_port; /*源地址端口*/
  95.     u_int16_t dest_port;    /*目的地址端口*/
  96.     u_int16_t len;     /*UDP长度*/
  97.     u_int16_t check;   /*UDP校验和*/
  99.     printf("---------UDP协议---------\n");
  100.     printf("源端口:%d\n", ntohs(udp_protocol->source_port));
  101.     printf("目的端口:%d\n", ntohs(udp_protocol->dest_port));
  102.     printf("UDP数据包长度:%d\n", ntohs(udp_protocol->len));
  103.     printf("UDP校验和:%d\n", checksum);
  104. }
  106. //TCP协议分析  
  107. void tcp_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  108. {
  109.     struct tcphdr *tcp_protocol;
  110.     u_int header_length = 0;
  111.     u_int offset;
  112.     u_char tos;
  113.     u_int16_t checksum;
  115.     tcp_protocol = (struct tcphdr *) packet_content;
  116.     checksum = ntohs(tcp_protocol->check);
  118.     printf("---------TCP协议---------\n");
  119.     printf("源端口:%d\n", ntohs(tcp_protocol->source_port));
  120.     printf("目的端口:%d\n", ntohs(tcp_protocol->dest_port));
  121.     printf("SEQ:%d\n", ntohl(tcp_protocol->seq));
  122.     printf("ACK SEQ:%d\n", ntohl(tcp_protocol->ack_seq));
  123.     printf("TCP校验和:%d\n", checksum);
  125.     if (ntohs(tcp_protocol->source_port) == 80 || ntohs(tcp_protocol->dest_port) == 80)//http协议 
  126.         printf("http data:\n%s\n", packet_content + sizeof(tcphdr));  
  127. }
  129. //IP协议分析  
  130. void ip_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  131. {
  132.     struct ip_header *ip_protocol;
  133.     u_int offset;
  134.     u_char tos;
  135.     u_int16_t checksum;
  137.     ip_protocol = (struct ip_header *)packet_content;
  138.     checksum = ntohs(ip_protocol->ip_checksum);
  139.     tos = ip_protocol->ip_tos;
  140.     offset = ntohs(ip_protocol->ip_off);
  142.     printf("---------IP协议---------\n");
  143.     printf("版本号:%d\n", ip_protocol->ip_version);
  144.     printf("首部长度:%d\n", ip_protocol->ip_header_length);
  145.     printf("服务质量:%d\n", tos);
  146.     printf("总长度:%d\n", ntohs(ip_protocol->ip_length));
  147.     printf("标识:%d\n", ntohs(ip_protocol->ip_id));
  148.     printf("偏移:%d\n", (offset & 0x1fff) * 8);
  149.     printf("生存时间:%d\n", ip_protocol->ip_ttl);
  150.     printf("协议类型:%d\n", ip_protocol->ip_protocol);
  151.     printf("检验和:%d\n", checksum);
  152.     printf("源IP地址:%d.%d.%d.%d\n", ip_protocol->saddr.byte1, ip_protocol->saddr.byte2, ip_protocol->saddr.byte3, ip_protocol->saddr.byte4);
  153.     printf("目的地址:%d.%d.%d.%d\n", ip_protocol->daddr.byte1, ip_protocol->daddr.byte2, ip_protocol->daddr.byte3, ip_protocol->daddr.byte4);
  155.     switch (ip_protocol->ip_protocol)
  156.     {
  157.     case 1: printf("上层协议是ICMP协议\n"); break;
  158.     case 2: printf("上层协议是IGMP协议\n"); break;
  159.     case 6:
  160.     {
  161.         printf("上层协议是TCP协议\n");  
  162.         tcp_protool_packet_callback(argument, packet_header, packet_content + sizeof(ip_header));
  163.     }
  164.     break;
  166.     case 17:
  167.     {
  168.         printf("上层协议是UDP协议\n");  
  169.         udp_protool_packet_callback(argument, packet_header, packet_content + sizeof(ip_header));
  170.     }
  171.     break;
  172.     default:break;
  173.     }
  174. }
  176. //以太网协议分析  
  177. void ethernet_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  178. {
  179.     u_short ethernet_type;
  180.     struct ether_header *ethernet_protocol;
  181.     u_char *mac_string;
  182.     static int packet_number = 1;
  183.     printf("----------------------------------------------\n");
  184.     printf("捕获第%d个网络数据包\n", packet_number);
  185.     printf("该数据包的具体内容：\n");
  186.     for (int i = 1; i <= packet_header->len; i++)
  187.     {
  188.         printf("%02x ", packet_content[i - 1]);
  189.         if (i % 8 == 0)
  190.             printf(" ");
  191.         if (i % 16 == 0)
  192.             printf("\n");
  193.     }
  194.     printf("\n");
  195.     printf("数据包长度:%d\n", packet_header->len);
  196.     printf("---------以太网协议---------\n");
  197.     ethernet_protocol = (struct ether_header*)packet_content;//获得数据包内容  
  198.     ethernet_type = ntohs(ethernet_protocol->ether_type);//获得以太网类型  
  199.     printf("以太网类型:%04x\n", ethernet_type);
  200.     mac_string = ethernet_protocol->ether_shost;
  201.     printf("MAC帧源地址:%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5));
  202.     mac_string = ethernet_protocol->ether_dhost;
  203.     printf("MAC帧目的地址:%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5));
  204.     switch (ethernet_type)
  205.     {
  206.         case 0x0800:
  207.         {
  208.             ip_protool_packet_callback(argument, packet_header, packet_content + sizeof(ether_header));
  209.             printf("上层协议是IPv4协议\n");
  210.         }
  211.             break;
  212.         case 0x0806: 
  213.             printf("上层协议是ARP协议\n"); 
  214.             break;
  215.         case 0x8035: 
  216.             printf("上层协议是RARP协议\n"); 
  217.             break;
  218.         case 0x814C: 
  219.             printf("上层协议是简单网络管理协议SNMP\n"); 
  220.             break;
  221.         case 0x8137: 
  222.             printf("上层协议是因特网包交换（IPX：Internet Packet Exchange）\n"); 
  223.             break;
  224.         case 0x86DD: 
  225.             printf("上层协议是IPv6协议\n"); 
  226.             break;
  227.         case 0x880B: 
  228.             printf("上层协议是点对点协议（PPP：Point-to-Point Protocol）\n"); 
  229.             break;
  230.         default:break;
  231.     }
  232.     printf("----------------------------------------------\n");
  233.     packet_number++;
  234. }
  236. int main()
  237. {
  238.     pcap_if_t * allAdapters;               //适配器列表  
  239.     pcap_if_t * adapter;                  //跑适配器列表
  240.     pcap_t    * adapterHandle;            //适配器句柄  
  241.     //char error_content[PCAP_ERRBUF_SIZE]; //存储错误信息  
  242.     bpf_u_int32 net_mask = 0;             //掩码地址  
  243.     bpf_u_int32 net_ip = 0;               //网络地址  
  244.     char *net_interface;                  //网络接口  
  245.     struct bpf_program bpf_filter;        //BPF过滤规则  
  246.     char bpf_filter_string[] = "ip";      //过滤规则字符串，只分析IPv4的数据包  
  247.     char errorBuffer[PCAP_ERRBUF_SIZE];   //错误信息缓冲区  
  248.     if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL,&allAdapters, errorBuffer) == -1) //检索机器连接的所有网络适配器 
  249.     {   
  250.         fprintf(stderr, "Error in pcap_findalldevs_ex function: %s\n", errorBuffer);
  251.         return -1;
  252.     }
  253.     if (allAdapters == NULL) //不存在任何适配器
  254.     {    
  255.         printf("\nNo adapters found! Make sure WinPcap is installed.\n");
  256.         return 0;
  257.     }
  258.     int crtAdapter = 0;
  259.     for (adapter = allAdapters; adapter != NULL; adapter = adapter->next)
  260.     {   //遍历输入适配器信息(名称和描述信息)  
  261.         printf("\n%d.%s ", ++crtAdapter, adapter->name);
  262.         printf("-- %s\n", adapter->description);
  263.     }
  264.     printf("\n");
  265.     int adapterNumber;
  266.     printf("Enter the adapter number between 1 and %d:", crtAdapter);//选择要捕获数据包的适配器 
  267.     scanf_s("%d", &adapterNumber);
  268.     if (adapterNumber < 1 || adapterNumber > crtAdapter)
  269.     {
  270.         printf("\nAdapter number out of range.\n");
  271.         pcap_freealldevs(allAdapters);// 释放适配器列表 
  272.         return -1;
  273.     }
  274.     adapter = allAdapters;
  275.     for (crtAdapter = 0; crtAdapter < adapterNumber - 1; crtAdapter++)
  276.         adapter = adapter->next;
  277.     adapterHandle = pcap_open(adapter->name, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errorBuffer);// 打开指定适配器 
  278.     if (adapterHandle == NULL)//指定适配器打开失败  
  279.     {
  280.         fprintf(stderr, "\nUnable to open the adapter\n", adapter->name);
  281.         pcap_freealldevs(allAdapters);// 释放适配器列表 
  282.         return -1;
  283.     }
  284.     char errbuf[2048];
  285.     pcap_createsrcstr(NULL, 0, NULL, "80", NULL, errbuf);
  287.     printf("\nCapture session started on  adapter %s\n", adapter->name);
  288.     pcap_freealldevs(allAdapters);//释放适配器列表  
  290.     pcap_compile(adapterHandle, &bpf_filter, bpf_filter_string, 0, net_ip); //编译过滤规则  
  291.     pcap_setfilter(adapterHandle, &bpf_filter);//设置过滤规则  
  292.     if (pcap_datalink(adapterHandle) != DLT_EN10MB) //DLT_EN10MB表示以太网  
  293.         return 0;
  294.     pcap_loop(adapterHandle, 30, ethernet_protocol_packet_callback, NULL); //捕获65536个数据包进行分析  
  295.     pcap_close(adapterHandle);
  296.     return 0;
  297. }
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注