java 网络抓包
网络抓包工具的首选是Sniffer。但分析数据时有局限性。比如我要同时监听所有的网卡。筛选发送到某个地址的数据生成绘图等等。
参考了 http://javafound.iteye.com/blog/165723 ，javafound 大神基于jpcap的网络实时监控程序。我想做数据分析，就在程序上改了一下去除了图形生成，改成了数据入库以便对数据进行分析。
主类：Tcpdump.java
package com.fitweber.socket;
import java.util.Map;
import jpcap.JpcapCaptor;
import jpcap.NetworkInterface;
/**
* 1.使用jpcap抓取网络流量的主类,
* 2.这个类要根据网卡个数,启动线程分别抓取各个网卡上的流量入表中
* 3.生成图表的对象从流量表中取出数据
* 4.这个类设计为单实例,在第一次调用时启动抓数据线程;
* 5.目前没有设计停止抓取机制....
* @author www.NetJava.cn modify by wheatmark
*/
public class Tcpdump {
private Tcpdump(){}
/**存入某个地址名字和流量统计值*/
private Map<String, Integer> nameTrafficMap=new java.util.HashMap();
//单实例
private static Tcpdump tcpdump=null;
public static void main(String args[]){
//启动统计线程
Tcpdump.ins();
}
/**
* 单实例调用：其它对象调用这个类的方法时,必须通过这个方法
* 这样,保证了流量统计线程的启动,且只启动了一次
* */
public synchronized static Tcpdump ins(){
if(null==tcpdump){
tcpdump=new Tcpdump();
tcpdump.init();
}
return tcpdump;
}
/**生成报表的Servlet调用用于生成图表中数据*/
public Map<String, Integer> getNameTrafficMap(){
return nameTrafficMap;
}
/**
* 根据网卡个数，启动统计线程
* 注意：本地地址，即127.0.0.1上的不统计
*/
private void init() {
try{
//获取本机上的网络接口对象
final NetworkInterface[] devices = JpcapCaptor.getDeviceList();
/*
* /172.16.175.242
*/
for(int i=0;i<devices.length;i++){
NetworkInterface nc=devices[i];
//大与零则为有效网卡,不抓本机地址.
if(nc.addresses.length>0){
//一个网卡可能有多个地址,只取第一个地址
String addr=nc.addresses[0].address.toString();
// 创建某个卡口上的抓取对象,
JpcapCaptor jpcap = JpcapCaptor.openDevice(nc, 2000, true, 100);
//创建对应的抓取线程并启动
LoopPacketThread lt=new LoopPacketThread(jpcap,addr,nc);
lt.start();
System.out.println( addr+"上的采集线程己启动************");
}
}
}catch(Exception ef){
ef.printStackTrace();
System.out.println("start caputerThread error ! ! ! !"+ef);
}
}
/**IP和抓到包的长度放入hash表中,用表中长度加入放入的长度*/
/**
void putNetValue(String name,int value){
if(nameTrafficMap.containsKey(name)){
value=nameTrafficMap.get(name)+value;
nameTrafficMap.put(name, value);
}else{
nameTrafficMap.put(name, value);
}
}
**/
}
// /**测试再加上一个内存监视线程*/
//class CheckMemory extends Thread{
//
// public void run(){
// while(true){
// try{
// //计算内存占用量
// long freeM= java.lang.Runtime.getRuntime().freeMemory();
// Long result=java.lang.Runtime.getRuntime().totalMemory()-freeM;
// String rs=""+result/1000;
// int is=Integer.parseInt(rs);
//
// Tcpdump.ins().putNetValue("这是内存占用", is);
//
// Thread.sleep(1000);
// }catch(Exception ef){
//
// }
// }
// }
//
//}
数据抓取：DumpPacket.java
package com.fitweber.socket;
import java.sql.Timestamp;
import java.text.SimpleDateFormat;
import java.util.Date;
import jpcap.NetworkInterface;
import jpcap.PacketReceiver;
import jpcap.packet.ARPPacket;
import jpcap.packet.EthernetPacket;
import jpcap.packet.IPPacket;
import jpcap.packet.Packet;
import jpcap.packet.TCPPacket;
import jpcap.packet.UDPPacket;
import com.fitweber.pojo.WebPacket;
import com.fitweber.util.DataLoger;
/**
* 抓包监听器,实现PacketReceiver中的方法,当数据包到达时计数.
* @author www.NetJava.cn
*/
class DumpPacket implements PacketReceiver {
private String ipAdd;
private DataLoger dataLoger;
private NetworkInterface nc;
private String addresses;
DumpPacket(String ipAdd,NetworkInterface nc){
this.ipAdd=ipAdd;
this.nc = nc;
this.addresses = nc.addresses[0].address.toString();
this.dataLoger = new DataLoger();
}
//实现包统计
public void receivePacket(Packet packet) {
WebPacket webPacket = new WebPacket();
webPacket.setAddresses(this.addresses);//监听网卡地址
EthernetPacket ethernetPacket = (EthernetPacket) packet.datalink;
webPacket.setSource_mac(ethernetPacket.getSourceAddress());//请求硬件地址
webPacket.setDest_mac(ethernetPacket.getDestinationAddress());//目标硬件地址
if("class jpcap.packet.ARPPacket".equals(packet.getClass().toString())){
ARPPacket arppacket = (ARPPacket) packet;
webPacket.setCaplen(arppacket.len);//网络包长度
webPacket.setHeader_data(arppacket.header);//报文头部信息
webPacket.setPacket_data(arppacket.data);//报文数据
webPacket.setReceive_date(new Timestamp(arppacket.sec*1000+arppacket.usec/1000));//收报时间
}else{
IPPacket ippacket = (IPPacket) packet;
webPacket.setSource_ip(ippacket.src_ip.getHostAddress());//请求IP地址
webPacket.setDest_ip(ippacket.dst_ip.getHostAddress());//目标IP地址
webPacket.setProtocol(ippacket.protocol);//网络协议
webPacket.setPriority(ippacket.priority);//优先级
webPacket.setVersion(ippacket.version);//版本
webPacket.setHop_limit(ippacket.hop_limit);//生存时间
webPacket.setIdent(ippacket.ident);//分组标识
webPacket.setCaplen(ippacket.len);//网络包长度
webPacket.setDatalen(ippacket.length);//数据包长度
webPacket.setHeader_data(ippacket.header);//报文头部信息
webPacket.setPacket_data(ippacket.data);//报文数据
webPacket.setReceive_date(new Timestamp(ippacket.sec*1000+ippacket.usec/1000));//收报时间
//System.out.println("服务类型(TOS) (v4/v6)："+ippacket.rsv_tos);
//System.out.println(ippacket);
if(ippacket.protocol == 6){
TCPPacket tcppacket =(TCPPacket) ippacket;
webPacket.setSrc_port(tcppacket.src_port);//源端口
webPacket.setDst_port(tcppacket.dst_port);//目标端口
}
if(ippacket.protocol == 17){
UDPPacket udppacket =(UDPPacket) ippacket;
webPacket.setSrc_port(udppacket.src_port);//源端口
webPacket.setDst_port(udppacket.dst_port);//目标端口
}
}
this.dataLoger.saveLog(webPacket);
}
/**
*日志时间信息
* @return：日志内容时间
*/
private static String currentTime(){
Date d = new Date();
SimpleDateFormat kk=new SimpleDateFormat("mm:ss");
String strTime=kk.format(d);
return strTime;
}
}
数据入库：DataLoger.java
package com.fitweber.util;
import java.io.IOException;
import java.io.InputStream;
import java.util.ArrayList;
import org.apache.ibatis.io.Resources;
import org.apache.ibatis.session.SqlSession;
import org.apache.ibatis.session.SqlSessionFactory;
import org.apache.ibatis.session.SqlSessionFactoryBuilder;
import com.fitweber.dao.WebPacketDao;
import com.fitweber.pojo.WebPacket;
public class DataLoger {
final private int LOGTIME = 50;
private ArrayList<WebPacket> webPacketArray = new ArrayList<WebPacket>();
private WebPacketDao webPacketDao;
public DataLoger(){
String resource = "META-INF/conf/mybatis-config.xml";
InputStream inputStream;
try {
inputStream = Resources.getResourceAsStream(resource);
SqlSessionFactory sqlSessionFactory = new SqlSessionFactoryBuilder().build(inputStream);
SqlSession session = sqlSessionFactory.openSession();
this.webPacketDao = session.getMapper(WebPacketDao.class);
} catch (IOException e) {
e.printStackTrace();
}
}
public void saveLog(WebPacket webPacket) {
if(webPacketArray.size()<LOGTIME){
webPacketArray.add(webPacket);
}else{
//保存数据
webPacketDao.insertWebPacket(webPacketArray);
webPacketArray.clear();
webPacketArray.add(webPacket);
}
}
}
这里汇总一下java 网络监听的知识点。把相关的资料传到 http://download.csdn.net/detail/super2007/5553057 。javafound 大神的项目包也传上去了。以后备用。