【网络协议】基于winpcap的以太网络抓包及协议分析

下面的程序只是一个简单的示例：

#include "stdafx.h"
#include "pcap.h"
#include<winsock2.h>

#pragma comment(lib,"wpcap.lib")
#pragma comment(lib,"packet.lib")
#pragma comment(lib,"ws2_32.lib")


void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content);
void ip_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content);
void tcp_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content);
void udp_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content);

//以太网协议头
struct ether_header
{
	u_int8_t ether_dhost[6]; //目的Mac地址
	u_int8_t ether_shost[6]; //源Mac地址
	u_int16_t ether_type;    //协议类型
};

//IPv4协议头
struct ip_header
{
#if defined(WORDS_BIENDIAN)
	u_int8_t    ip_version:4,ip_header_length:4;
#else
	u_int8_t    ip_header_length:4,ip_version:4;
#endif
	u_int8_t    ip_tos;
	u_int16_t   ip_length;
	u_int16_t   ip_id;
	u_int16_t   ip_off;
	u_int8_t    ip_ttl;
	u_int8_t    ip_protocol;
	u_int16_t   ip_checksum;
	struct in_addr ip_souce_address;
	struct in_addr ip_destination_address;
};

//UDP协议头
struct udphdr
{
	u_int16_t source_port; /*源地址端口*/
	u_int16_t dest_port;    /*目的地址端口*/
	u_int16_t len;     /*UDP长度*/
	u_int16_t check;   /*UDP校验和*/
}; 

//TCP协议头
#define __LITTLE_ENDIAN_BITFIELD
struct tcphdr 
{
	u_int16_t   source_port;         /*源地址端口*/
	u_int16_t   dest_port;           /*目的地址端口*/
	u_int32_t   seq;            /*序列号*/
	u_int32_t   ack_seq;        /*确认序列号*/
#if defined(__LITTLE_ENDIAN_BITFIELD)
	u_int16_t res1:4,   /*保留*/
	doff:4,				/*偏移*/
	fin:1,              /*关闭连接标志*/
	syn:1,              /*请求连接标志*/
	rst:1,              /*重置连接标志*/
	psh:1,              /*接收方尽快将数据放到应用层标志*/
	ack:1,              /*确认序号标志*/
	urg:1,              /*紧急指针标志*/
	ece:1,              /*拥塞标志位*/
	cwr:1;              /*拥塞标志位*/
#elif defined(__BIG_ENDIAN_BITFIELD)
	u_int16_t doff:4,   /*偏移*/
	res1:4,             /*保留*/
	cwr:1,              /*拥塞标志位*/
	ece:1,              /*拥塞标志位*/
	urg:1,              /*紧急指针标志*/
	ack:1,              /*确认序号标志*/
	psh:1,              /*接收方尽快将数据放到应用层标志*/
	rst:1,              /*重置连接标志*/
	syn:1,              /*请求连接标志*/
	fin:1;              /*关闭连接标志*/
#else
	u_int16_t	flag;
#endif 
	u_int16_t   window;         /*滑动窗口大小*/
	u_int16_t   check;          /*校验和*/
	u_int16_t   urg_ptr;        /*紧急字段指针*/
};

//以太网协议分析
void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
	u_short ethernet_type;
	struct ether_header *ethernet_protocol;
	u_char *mac_string;
	static int packet_number = 1;
	printf("----------------------------------------------\n");
	printf("捕获第%d个网络数据包\n",packet_number);
	printf("捕获时间:%d\n",packet_header->ts.tv_sec);
	printf("数据包长度:%d\n",packet_header->len);
	printf("---------以太网协议---------\n");
	ethernet_protocol=(struct ether_header*)packet_content;//获得数据包内容
	ethernet_type=ntohs(ethernet_protocol->ether_type);//获得以太网类型
	printf("以太网类型:%04x\n",ethernet_type);
	switch (ethernet_type)
	{
	case 0x0800: printf("上层协议是IPv4协议\n");break;
	case 0x0806: printf("上层协议是ARP协议\n");break;
	case 0x8035: printf("上层协议是RARP协议\n");break;
	case 0x814C: printf("上层协议是简单网络管理协议SNMP\n");break;
	case 0x8137: printf("上层协议是因特网包交换（IPX：Internet Packet Exchange）\n");break;
	case 0x86DD: printf("上层协议是IPv6协议\n");break;
	case 0x880B: printf("上层协议是点对点协议（PPP：Point-to-Point Protocol）\n");break;
	default:break;
	}

	mac_string=ethernet_protocol->ether_shost;
	printf("MAC帧源地址:%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
	mac_string=ethernet_protocol->ether_dhost;
	printf("MAC帧目的地址:%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
	if(ethernet_type==0x0800)//继续分析IP协议
	{
		ip_protool_packet_callback (argument,packet_header,packet_content+sizeof(ether_header));
	}
	printf("----------------------------------------------\n");
	packet_number++;
}

//IP协议分析
void ip_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
	struct ip_header *ip_protocol;
	u_int header_length=0;
	u_int offset;
	u_char tos;
	u_int16_t checksum;

	ip_protocol = (struct ip_header *)packet_content;
	checksum =ntohs(ip_protocol->ip_checksum);
	tos = ip_protocol->ip_tos;
	offset = ntohs(ip_protocol->ip_off);
	printf("---------IP协议---------\n");
	printf("版本号:%d\n", ip_protocol->ip_version);
	printf("首部长度:%d\n",header_length);
	printf("服务质量:%d\n",tos);
	printf("总长度:%d\n",ntohs(ip_protocol->ip_length));
	printf("标识:%d\n",ntohs(ip_protocol->ip_id));
	printf("偏移:%d\n",(offset & 0x1fff) * 8);
	printf("生存时间:%d\n",ip_protocol->ip_ttl);
	printf("协议类型:%d\n",ip_protocol->ip_protocol);

	printf("检验和:%d\n",checksum);
	printf("源IP地址:%s\n", inet_ntoa(ip_protocol->ip_souce_address));
	printf("目的地址:%s\n", inet_ntoa(ip_protocol->ip_destination_address));

	switch (ip_protocol->ip_protocol)
	{
	case 1: printf("上层协议是ICMP协议\n");break;
	case 2: printf("上层协议是IGMP协议\n");break;
	case 6: 
		{
			//printf("上层协议是TCP协议\n");
			tcp_protool_packet_callback (argument,packet_header,packet_content+sizeof(ip_header));
		}
		break;

	case 17: 
		{
			//printf("上层协议是UDP协议\n");
			udp_protool_packet_callback (argument,packet_header,packet_content+sizeof(ip_header));
		}
		break;
	default:break;
	}
	
}

//TCP协议分析
void tcp_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
	struct tcphdr *tcp_protocol;
	u_int header_length=0;
	u_int offset;
	u_char tos;
	u_int16_t checksum;

	tcp_protocol = (struct tcphdr *) packet_content;
	checksum =ntohs(tcp_protocol->check);

	printf("---------TCP协议---------\n");
	printf("源端口:%d\n", ntohs(tcp_protocol->source_port));
	printf("目的端口:%d\n",ntohs(tcp_protocol->dest_port));
	printf("SEQ:%d\n",ntohl(tcp_protocol->seq));
	printf("ACK SEQ:%d\n",ntohl(tcp_protocol->ack_seq));
	printf("check:%d\n",checksum);

	
	if(ntohs(tcp_protocol->source_port)==80 || ntohs(tcp_protocol->dest_port)==80)
	{
		//http协议
		printf("http data:\n%s\n",packet_content+sizeof(tcphdr));
	}

}

//UDP协议分析
void udp_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
	struct udphdr *udp_protocol;
	u_int header_length=0;
	u_int16_t checksum;

	udp_protocol = (struct udphdr *) packet_content;
	checksum =ntohs(udp_protocol->check);

	u_int16_t source_port; /*源地址端口*/
	u_int16_t dest_port;    /*目的地址端口*/
	u_int16_t len;     /*UDP长度*/
	u_int16_t check;   /*UDP校验和*/

	printf("---------UDP协议---------\n");
	printf("源端口:%d\n", udp_protocol->source_port);
	printf("目的端口:%d\n",udp_protocol->dest_port);
	printf("len:%d\n",udp_protocol->len);
	printf("check:%d\n",checksum);

}

int main()
{
	//pcap_t* pcap_handle; //winpcap句柄
	char error_content[PCAP_ERRBUF_SIZE]; //存储错误信息
	bpf_u_int32 net_mask=0; //掩码地址
	bpf_u_int32 net_ip=0;  //网络地址
	char *net_interface;  //网络接口
	struct bpf_program bpf_filter;  //BPF过滤规则
	char bpf_filter_string[]="ip"; //过滤规则字符串，只分析IPv4的数据包

	pcap_if_t * allAdapters;//适配器列表
	pcap_if_t * adapter;
	pcap_t           * adapterHandle;//适配器句柄

	char errorBuffer[ PCAP_ERRBUF_SIZE ];//错误信息缓冲区
	if( pcap_findalldevs_ex( PCAP_SRC_IF_STRING, NULL, 
		&allAdapters, errorBuffer ) == -1 )
	{	//检索机器连接的所有网络适配器
		fprintf( stderr, "Error in pcap_findalldevs_ex function: %s\n", errorBuffer );
		return -1;
	}
	if( allAdapters == NULL )
	{	//不存在任何适配器
		printf( "\nNo adapters found! Make sure WinPcap is installed.\n" );
		return 0;
	}
	int crtAdapter = 0;
	for( adapter = allAdapters; adapter != NULL; adapter = adapter->next)
	{	//遍历输入适配器信息(名称和描述信息)
		printf( "\n%d.%s ", ++crtAdapter, adapter->name ); 
		printf( "-- %s\n", adapter->description );
	}
	printf( "\n" );
	//选择要捕获数据包的适配器
	int adapterNumber;
	printf( "Enter the adapter number between 1 and %d:", crtAdapter );
	scanf_s( "%d", &adapterNumber );
	if( adapterNumber < 1 || adapterNumber > crtAdapter )
	{
		printf( "\nAdapter number out of range.\n" );
		// 释放适配器列表
		pcap_freealldevs( allAdapters );
		return -1;
	}
	adapter = allAdapters;
	for( crtAdapter = 0; crtAdapter < adapterNumber - 1; crtAdapter++ )
		adapter = adapter->next;
	// 打开指定适配器
	adapterHandle = pcap_open( adapter->name, // name of the adapter
		65536,         // portion of the packet to capture
		// 65536 guarantees that the whole 
		// packet will be captured
		PCAP_OPENFLAG_PROMISCUOUS, // promiscuous mode
		1000,             // read timeout - 1 millisecond
		NULL,          // authentication on the remote machine
		errorBuffer    // error buffer
		);
	if( adapterHandle == NULL )
	{//指定适配器打开失败
		fprintf( stderr, "\nUnable to open the adapter\n", adapter->name );
		// 释放适配器列表
		pcap_freealldevs( allAdapters );
		return -1;
	}

	char errbuf[2048];
	pcap_createsrcstr(NULL, 0, NULL, "80", NULL, errbuf);

	printf( "\nCapture session started on  adapter %s\n", adapter->name );
	pcap_freealldevs( allAdapters );//释放适配器列表

	pcap_compile(adapterHandle,&bpf_filter,bpf_filter_string,0,net_ip); //编译过滤规则
	pcap_setfilter(adapterHandle,&bpf_filter);//设置过滤规则
	if (pcap_datalink(adapterHandle)!=DLT_EN10MB) //DLT_EN10MB表示以太网
		return 0;
	pcap_loop(adapterHandle,65536,ethernet_protocol_packet_callback,NULL); //捕获65536个数据包进行分析

	pcap_close(adapterHandle);
	return 0;
}