[关闭]
@xunuo 2017-08-10T08:51:43.000000Z 字数 9547 阅读 1164

C#分析ip分片重组

网络数据包分析

sharppcap 链表 byte[]转string

  1. using System;
  2. using System.Collections.Generic;
  3. using System.Linq;
  4. using System.Text;
  5. using System.Threading.Tasks;
  6. using SharpPcap;
  7. using SharpPcap.LibPcap;
  8. using PacketDotNet;
  9. using TwzyProtocol;
  10. namespace practice1
  11. {
  12.     public class ipdata
  13.     {
  14.         public int flag;
  15.         public int offest;
  16.         public string data; 
  17.         public ipdata() { }
  18.         public  ipdata next;
  19.         public ipdata pre;
  21.     }
  22.     public class ipid
  23.     {
  24.         public ushort id;
  25.         public ipid() { }
  26.         public  ipid next;
  27.         public ipdata ipdatahead;
  28.     }
  29.     class Program
  30.     {
  31.         static int[] idlist = new int[200];
  32.         static int num = 0;
  33.         public static ipid ipidhead = new ipid();
  34.         public static ipid ipidheader = new ipid();
  35.         static int vis = 0;
  36.         static string stringdata;
  37.         static void Main(string[] args)
  38.         {
  39.             //获取网络设备
  40.             var device = CaptureDeviceList.Instance;
  41.             if (device.Count < 1)
  42.             {
  43.                 Console.WriteLine("暂无可用网络设备！\n");
  44.                 return;
  45.             }
  46.             int i = 0;
  47.             foreach (ICaptureDevice cap in device)
  48.             {
  49.                 Console.WriteLine("{0},{1},{2}", i, cap.Name, cap.Description);//打印所有可用网络设备;
  50.                 i++;
  51.             }
  52.             //选择为要用的设备：
  53.             Console.WriteLine("请选择要使用的网络设备:");
  54.             int j = int.Parse(Console.ReadLine());
  55.             if (j > i || j < 0)
  56.             {
  57.                 Console.WriteLine("该设备不存在！\n");
  58.                 return;
  59.             }
  60.             ICaptureDevice dev = device[j];
  61.             //string filter = "ip and tcp";
  62.             ipidhead.next = null;
  63.             ipidhead.ipdatahead = null;
  64.             dev.OnPacketArrival += new PacketArrivalEventHandler(dev_OnPacketArrival);
  65.             dev.Open(DeviceMode.Normal, 1000);
  66.             dev.Filter = "ip net 222.196.33.253";
  67.             dev.StartCapture();
  68.         } 
  70.         public static string ToHexString(byte[] bytes) // byte[]转16进制string
  71.         {
  72.             string hexString = string.Empty;
  73.             if (bytes != null)
  74.             {
  75.                 StringBuilder strB = new StringBuilder();
  76.                 for (int i = 0; i < bytes.Length; i++)
  77.                 {
  78.                     strB.Append(bytes[i].ToString("X2"));
  79.                 }
  80.                 hexString = strB.ToString();
  81.             }
  82.             return hexString;
  83.         }
  85.         static void dev_OnPacketArrival(object sender, CaptureEventArgs e)
  86.         {
  87.            // packetdata = e.Packet.Data;
  88.             stringdata = ToHexString(e.Packet.Data);
  89.        //   Console.WriteLine(ToHexString(packetdata));
  90.             if (e.Packet.LinkLayerType == LinkLayers.Ethernet)
  91.             {
  92.                 var packet = PacketDotNet.Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
  93.                 Ethernet(packet);
  94.             }
  95.         }
  97.         static private void Ethernet(Packet packet)
  98.         {
  99.             var Ethernetpacket = PacketDotNet.EthernetPacket.GetEncapsulated(packet);
  100.             if (Ethernetpacket.Type == EthernetPacketType.IpV4 || Ethernetpacket.Type == EthernetPacketType.IpV6)
  101.             {
  102.                 IpPacket ip = IpPacket.GetEncapsulated(packet);
  103.                 Ip(ip, packet);
  104.             }
  105.         }
  106.         static private void Ip(IpPacket ip, Packet packet)
  107.         {
  108.             Console.WriteLine("总长度：" + ip.TotalLength);
  109.             if (ip.Version == IpVersion.IPv4)
  110.             {
  111.                 IPv4Packet ipv4 = ip as IPv4Packet;
  112.                 Console.WriteLine("Identification:" + ipv4.Id);
  113.                 Console.WriteLine("flag:" + ipv4.FragmentFlags);
  114.                 Console.WriteLine("偏移：" + ipv4.FragmentOffset.ToString());
  115.                 if(ipv4.FragmentFlags==1&&vis==0)
  116.                 {
  117.                     createipid(ipidhead, ipv4.Id);
  118.                     insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  119.                     idlist[num++] = ipv4.Id;
  120.                     vis = 1; 
  121.                 }
  122.                 else if(ipv4.FragmentFlags==1&&vis==1)
  123.                 {
  124.                     insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  125.                 }
  126.                 else if(ipv4.FragmentFlags==0)
  127.                 {
  128.                     for(int i=0;i<num;i++)
  129.                     {
  130.                         if (ipv4.Id == idlist[i])
  131.                         {
  132.                             insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  133.                             vis = 0;
  134.                         }
  135.                     } 
  136.                     print(ipidhead, ipv4.Id);
  137.                 }
  138.             }
  139.         }
  140.         public static void createipid(ipid ipidhead,ushort ipv4id)
  141.         {
  142.             ipid ipidroot = ipidhead;
  143.             while (!isempty(ipidroot))
  144.             {
  145.                 ipidroot = ipidroot.next;
  146.             }
  147.             ipidroot.id = ipv4id;
  148.             ipidroot.next = new ipid();
  149.             ipidroot.next.next = null;
  150.             ipidroot.ipdatahead = null;
  151.         }
  152.         public static bool isempty(ipid ipidhead)
  153.         {
  154.             if (ipidhead.next == null)
  155.                 return true;
  156.             else
  157.                 return false;
  158.         }
  159.         public static void insert(ipid ipidhead,ushort ipv4id,int flag,int offest,string stringdata)
  160.         {
  161.             while(!search(ipidhead,ipv4id))
  162.             {
  163.                 ipidhead = ipidhead.next;
  164.             }
  165.             if(ipidhead.ipdatahead==null)
  166.             {
  167.                 ipdata ipdataheader = new ipdata();
  168.                 ipidhead.ipdatahead = ipdataheader;
  169.                 ipdataheader.next = null;
  170.                 ipdataheader.flag = flag;
  171.                 ipdataheader.offest = offest;
  172.                string data = stringdata;
  173.               /*  if (flag == 0)
  174.                 {
  175.                     ipdataheader.data = data.Substring((14 + 20)*2);
  176.                 }
  177.                 else
  178.                 {*/
  179.                     ipdataheader.data = data.Substring((14 + 20)*2);
  180.                // }
  181.             }
  182.             else
  183.             {
  184.                 ipdata ipdataheader = ipidhead.ipdatahead;
  185.                 ipdata ipdatanewheader = new ipdata();
  186.                 ipdatanewheader.flag = flag;
  187.                 ipdatanewheader.offest = offest;
  188.                 ipdatanewheader.next = null;
  189.                 string data = stringdata;
  190.                /* if (flag == 0)
  191.                 {
  192.                     ipdatanewheader.data = data.Substring((14 + 20)*2);
  193.                 }
  194.                 else
  195.                 {*/
  196.                     ipdatanewheader.data = data.Substring((14 + 20)*2);
  197.                // }
  198.                 while(ipdataheader.offest<ipdatanewheader.offest)
  199.                 {
  200.                     if (ipdataheader.next == null || ipdataheader.next.offest > ipdatanewheader.offest)
  201.                     {
  202.                         ipdatanewheader.pre = ipdataheader;
  203.                         ipdatanewheader.next = ipdataheader.next;
  204.                         ipdataheader.next = ipdatanewheader;
  205.                         ipdataheader.next.pre = ipdatanewheader;
  206.                     }
  207.                     else
  208.                         ipdataheader = ipdataheader.next;
  209.                 }
  210.             }
  211.         }
  212.         public static bool search(ipid ipidhead,ushort ipv4id)
  213.         {
  214.             if (ipidhead.id == ipv4id)
  215.                 return true;
  216.             else
  217.                 return false;
  218.         }
  219.        public static  void print(ipid ipidhead,ushort ipv4id)
  220.         {
  221.               ipid ipidheader = ipidhead;
  222.             while(!search(ipidheader,ipv4id))
  223.             {
  224.                 ipidheader = ipidheader.next;
  225.             }
  226.             ipdata ipdataheader = ipidheader.ipdatahead;
  227.             while(ipdataheader.next!=null)
  228.             {
  229.                 Console.WriteLine(ipdataheader.data); 
  230.                 ipdataheader = ipdataheader.next;
  231.             }
  232.             if(ipdataheader.next==null&&ipdataheader.data!=null)
  233.             {
  234.                 Console.WriteLine(ipdataheader.data);
  235.             }
  236.         }
  237.     }
  238. }

1.主函数：

  1. using System;
  2. using System.Collections.Generic;
  3. using System.Linq;
  4. using System.Text;
  5. using System.Threading.Tasks;
  6. using SharpPcap;
  7. using SharpPcap.LibPcap;
  8. using PacketDotNet;
  9. using TwzyProtocol;
  10. namespace practice1
  11. {
  12.     class Program
  13.     {
  14.         //static int vis = 0;
  15.         static string stringdata;
  16.         static void Main(string[] args)
  17.         {
  18.             //获取网络设备
  19.             var device = CaptureDeviceList.Instance;
  20.             if (device.Count < 1)
  21.             {
  22.                 Console.WriteLine("暂无可用网络设备！\n");
  23.                 return;
  24.             }
  25.             int i = 0;
  26.             foreach (ICaptureDevice cap in device)
  27.             {
  28.                 Console.WriteLine("{0},{1},{2}", i, cap.Name, cap.Description);//打印所有可用网络设备;
  29.                 i++;
  30.             }
  31.             //选择为要用的设备：
  32.             Console.WriteLine("请选择要使用的网络设备:");
  33.             int j = int.Parse(Console.ReadLine());
  34.             if (j > i || j < 0)
  35.             {
  36.                 Console.WriteLine("该设备不存在！\n");
  37.                 return;
  38.             }
  39.             ICaptureDevice dev = device[j];
  40.             //string filter = "ip and tcp";
  41.             dev.OnPacketArrival += new PacketArrivalEventHandler(dev_OnPacketArrival);
  42.             dev.Open(DeviceMode.Normal, 1000);
  43.             dev.Filter = "ip net 222.196.33.253";
  44.             dev.StartCapture();
  45.         }
  46.         /*主函数中要初始化这两个
  47.             * ipidhead.next = null;
  48.             * ipidhead.ipdatahead = null;
  49.          */
  51.         public static string ToHexString(byte[] bytes) // byte[]转16进制string
  52.         {
  53.             string hexString = string.Empty;
  54.             if (bytes != null)
  55.             {
  56.                 StringBuilder strB = new StringBuilder();
  57.                 for (int i = 0; i < bytes.Length; i++)
  58.                 {
  59.                     strB.Append(bytes[i].ToString("X2"));
  60.                 }
  61.                 hexString = strB.ToString();
  62.             }
  63.             return hexString;
  64.         }
  66.         static void dev_OnPacketArrival(object sender, CaptureEventArgs e)
  67.         {
  68.            // packetdata = e.Packet.Data;
  69.             stringdata = ToHexString(e.Packet.Data);
  70.        //   Console.WriteLine(ToHexString(packetdata));
  71.             if (e.Packet.LinkLayerType == LinkLayers.Ethernet)
  72.             {
  73.                 var packet = PacketDotNet.Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
  74.                 Ethernet(packet);
  75.             }
  76.         }
  78.         static private void Ethernet(Packet packet)
  79.         {
  80.             var Ethernetpacket = PacketDotNet.EthernetPacket.GetEncapsulated(packet);
  81.             if (Ethernetpacket.Type == EthernetPacketType.IpV4 || Ethernetpacket.Type == EthernetPacketType.IpV6)
  82.             {
  83.                 IpPacket ip = IpPacket.GetEncapsulated(packet);
  84.                 Class1.Ip(ip,stringdata);
  85.             }
  86.         }
  88.     }
  89. }

2.ip类

  1. using System;
  2. using System.Collections.Generic;
  3. using System.Linq;
  4. using System.Text;
  5. using System.Threading.Tasks;
  6. using SharpPcap;
  7. using SharpPcap.LibPcap;
  8. using PacketDotNet;
  9. using TwzyProtocol;
  10. namespace practice1
  11. {
  12.     public class ipdata
  13.     {
  14.         public int flag;
  15.         public int offest;
  16.         public string data;
  17.         public ipdata() { }
  18.         public ipdata next;
  19.         public ipdata pre;
  21.     }
  22.     public class ipid
  23.     {
  24.         public ushort id;
  25.         public ipid() { }
  26.         public ipid next;
  27.         public ipdata ipdatahead;
  28.     }
  29.     class Class1
  30.     {
  31.         static int[] idlist = new int[200];
  32.         static int num = 0;
  33.         public static ipid ipidhead = new ipid();
  34.         public static ipid ipidheader = new ipid();
  35.         static int vis = 0;
  36.        public static  void Ip(IpPacket ip,string stringdata)
  37.         {
  38.             Console.WriteLine("总长度：" + ip.TotalLength);
  39.             if (ip.Version == IpVersion.IPv4)
  40.             {
  41.                 IPv4Packet ipv4 = ip as IPv4Packet;
  42.                 Console.WriteLine("Identification:" + ipv4.Id);
  43.                 Console.WriteLine("flag:" + ipv4.FragmentFlags);
  44.                 Console.WriteLine("偏移：" + ipv4.FragmentOffset.ToString());
  45.                 if (ipv4.FragmentFlags == 1 && vis == 0)
  46.                 {
  47.                     createipid(ipidhead, ipv4.Id);
  48.                     insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  49.                     idlist[num++] = ipv4.Id;
  50.                     vis = 1;
  51.                 }
  52.                 else if (ipv4.FragmentFlags == 1 && vis == 1)
  53.                 {
  54.                     insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  55.                 }
  56.                 else if (ipv4.FragmentFlags == 0)
  57.                 {
  58.                     for (int i = 0; i < num; i++)
  59.                     {
  60.                         if (ipv4.Id == idlist[i])
  61.                         {
  62.                             insert(ipidhead, ipv4.Id, ipv4.FragmentFlags, ipv4.FragmentOffset, stringdata);
  63.                             vis = 0;
  64.                         }
  65.                     }
  66.                     Console.WriteLine(print(ipidhead, ipv4.Id));
  67.                 }
  68.             }
  69.         }
  70.         public static void createipid(ipid ipidhead, ushort ipv4id)
  71.         {
  72.             ipid ipidroot = ipidhead;
  73.             while (!isempty(ipidroot))
  74.             {
  75.                 ipidroot = ipidroot.next;
  76.             }
  77.             ipidroot.id = ipv4id;
  78.             ipidroot.next = new ipid();
  79.             ipidroot.next.next = null;
  80.             ipidroot.ipdatahead = null;
  81.         }
  82.         public static bool isempty(ipid ipidhead)
  83.         {
  84.             if (ipidhead.next == null)
  85.                 return true;
  86.             else
  87.                 return false;
  88.         }
  89.         public static void insert(ipid ipidhead, ushort ipv4id, int flag, int offest, string stringdata)
  90.         {
  91.             while (!search(ipidhead, ipv4id))
  92.             {
  93.                 ipidhead = ipidhead.next;
  94.             }
  95.             if (ipidhead.ipdatahead == null)
  96.             {
  97.                 ipdata ipdataheader = new ipdata();
  98.                 ipidhead.ipdatahead = ipdataheader;
  99.                 ipdataheader.next = null;
  100.                 ipdataheader.flag = flag;
  101.                 ipdataheader.offest = offest;
  102.                 string data = stringdata;
  103.                 ipdataheader.data = data.Substring((14 + 20) * 2);
  104.             }
  105.             else
  106.             {
  107.                 ipdata ipdataheader = ipidhead.ipdatahead;
  108.                 ipdata ipdatanewheader = new ipdata();
  109.                 ipdatanewheader.flag = flag;
  110.                 ipdatanewheader.offest = offest;
  111.                 ipdatanewheader.next = null;
  112.                 string data = stringdata;
  113.                 ipdatanewheader.data = data.Substring((14 + 20) * 2);
  114.                 while (ipdataheader.offest < ipdatanewheader.offest)
  115.                 {
  116.                     if (ipdataheader.next == null || ipdataheader.next.offest > ipdatanewheader.offest)
  117.                     {
  118.                         ipdatanewheader.pre = ipdataheader;
  119.                         ipdatanewheader.next = ipdataheader.next;
  120.                         ipdataheader.next = ipdatanewheader;
  121.                         ipdataheader.next.pre = ipdatanewheader;
  122.                     }
  123.                     else
  124.                         ipdataheader = ipdataheader.next;
  125.                 }
  126.             }
  127.         }
  128.         public static bool search(ipid ipidhead, ushort ipv4id)
  129.         {
  130.             if (ipidhead.id == ipv4id)
  131.                 return true;
  132.             else
  133.                 return false;
  134.         }
  135.         public static string print(ipid ipidhead, ushort ipv4id)
  136.         {
  137.             string s="";
  138.             ipid ipidheader = ipidhead;
  139.             while (!search(ipidheader, ipv4id))
  140.             {
  141.                 ipidheader = ipidheader.next;
  142.             }
  143.             ipdata ipdataheader = ipidheader.ipdatahead;
  144.             while (ipdataheader.next != null)
  145.             {
  146.                 s += ipdataheader.data;
  147.                 //Console.WriteLine(ipdataheader.data);
  148.                 ipdataheader = ipdataheader.next;
  149.             }
  150.             if (ipdataheader.next == null && ipdataheader.data != null)
  151.             {
  152.                 s += ipdataheader.data;
  153.                // Console.WriteLine(ipdataheader.data);
  154.             }
  155.             return s;
  156.         }
  157.     }
  158. }
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注