MFC下介绍Sniff网络嗅探器代码
typedef struct _IPHEADER //IP头结构
{
unsigned char header_len:4; //IP头大小，4个字节存放
unsigned char version:4; //IP版本,4个字节存放
unsigned char tos; //服务类型
unsigned short total_len; //数据报大小
unsigned short ident; //数字报标识
unsigned short flags; //一种标志
unsigned char ttl;
unsigned char proto; //协议
unsigned short charSum; //IP数据包检验
unsigned int sourceIP; //源ip
unsigned int destIP; //目的ip
}IPHEADER;
struct TCPPacketHead //传输控制协议头结构
{
WORD SourPort ; //源端口
WORD DestPort; //目的端口
WORD SeqNo; //序列号
DWORD AckNo;
BYTE HLen ; //头大小
BYTE Flag; //标志
WORD WndSize;
WORD ChkSum; //校验位
WORD UrgPtr;
};
struct UDPPacketHead //数据包包头结构
{
WORD SourPort; //源端口
WORD DestPort; //目的端口
WORD Len; //头大小
WORD ChkSum; //校验位
};
struct TCMPPacketHead //ICMP网际控制报文协议
{
BYTE Type; //协议类型
BYTE Code;
WORD ChkSum; //校验
};
int iRet = 0;
char buf[1000];
char* bufwork;
IPHEADER* pIpHeader;
in_addr ina;
char szSource[16], szDest[16], szErr[50];
char* pSource, *pDest;
char* pLastBuf = NULL;
WORD sourport, destport;
int HdrLen, totallen;
struct TCPPacketHead * pTCPHead;
struct TCMPPacketHead* pICMPHead;
struct UDPPacketHead* pUDPHead;
BYTE* pData = NULL;
while(true) //死循环
{
//检测消息队列中的WM_CLOSE消息
memset(buf, 0, sizeof(buf)); //初始化字符数组
//接收数据
iRet = recv(pDlg->m_socket, buf, sizeof(buf), 0);
if(*buf)
{
bufwork = buf; //字符串赋值
pIpHeader = (IPHEADER*)bufwork; //获取ip包的头
WORD iLen= ntohs(pIpHeader->total_len); //获得数据包大小
while(true) //嵌套死循环分析数据
{
if(iLen < iRet) //如果数据报大小小于接收到的数据大小
{
ina.S_un.S_addr = pIpHeader->sourceIP; //获取源ip
pSource = inet_ntoa(ina); //将网络ip转化为主机上的源ip地址
strcpy(szSource, pSource);
ina.S_un.S_addr = pIpHeader->destIP; //获取目标ip
pDest = inet_ntoa(ina); //将网络ip转化为主机上的目标ip地址
strcpy(szDest, pDest);
CString str, strProto, strSourPort, strDestPort, strData, strSize;
//得到数据报的协议名称
// strProto = get_proto_name(pIpHeader->proto);
HdrLen = pIpHeader->header_len&0xf; //获得IP头大小
HdrLen *= 4;
totallen = ntohs(pIpHeader->total_len); //获得数据报大小，转化为主机
totallen -= HdrLen; //数据包大小除去IP头大小
//对不同协议的头部数据进行分析
switch(pIpHeader->proto)
{
case IPPROTO_ICMP: //网际控制报文协议
{
pICMPHead = (struct TCMPPacketHead*)(buf+HdrLen); //获取除去IP头的ICMP报文
strSourPort = "-";
strDestPort = "-";
pData = ((BYTE*)pICMPHead) + ICMP_HEAD_LEN; //保存出去ICMP头的字节内容
totallen -= ICMP_HEAD_LEN; //总大小出去IP头和ICMP头后
break;
}
case IPPROTO_TCP: //传输控制协议
{
pTCPHead = (struct TCPPacketHead *)(buf+HdrLen); //获取除去IP头的TCP报文
sourport = ntohs(pTCPHead->SourPort); //得到源端口和目的端口号
destport = ntohs(pTCPHead->DestPort);
strSourPort.Format("%d",sourport );
strDestPort.Format("%d",destport);
HdrLen = (pTCPHead->HLen)>>4;
HdrLen *= 4;
pData = ((BYTE*)pTCPHead) +HdrLen; // //保存出去TCP头的字节内容
totallen -= HdrLen; //总大小出去IP头和TCP头后
break;
}
case IPPROTO_UDP:
{
pUDPHead = (struct UDPPacketHead*)(buf+HdrLen); //获取除去IP头的UDP报文
sourport = ntohs(pUDPHead->SourPort); //得到源端口和目的端口号
destport = ntohs(pUDPHead->DestPort);
strSourPort.Format("%d",sourport );
strDestPort.Format("%d",destport);
pData = ((BYTE*)pTCPHead) +UDP_HEAD_LEN; // //保存除去UDP头的字节内容
totallen -= UDP_HEAD_LEN; //总大小出去IP头和UDP头后
break;
}
}
// CString strSize, strData;
strSize.Format("%d",totallen );
strData.Format("%s", pData);
pDlg->AddData("", szSource, strSourPort, szDest, strDestPort,strSize, strData);
if(iLen < iRet) //保证获取完整的ip包
{
iRet -= iLen;
bufwork += iLen;
pIpHeader = (IPHEADER*)bufwork; //获取ip包的头
}
else
break; //如果pIpHeader->total_len == iRet就退出
}
else //如果pIpHeader->total_len ,已经读到buffer的最后部分，就是i包的长度
{
int iLast = iLen -iRet; //剩余的数据
pLastBuf = new char[iLen];
int iReaden = iRet; //已经达到的数据
memcpy(pLastBuf, bufwork, iReaden); //已经到达的数据
iRet = recv(pDlg->m_socket, pLastBuf+iReaden, iLast, 0) //继续接收剩余的数据，并存入之前的总接收包中，从iReaden处开始
bufwork = pLastBuf; //记录总的接收数据
pIpHeader = (IPHEADER*)bufwork; //改变获取ip包的头
if(iRet !=iLast ) //如果还是没有接收完剩余数据.，就读
{
iReaden+=iRet; //已经到达的数据
iLast -= iRet; // 剩余的数据
while(true)
{
//继续接收剩余的数据，并存入之前的总接收包中，从iReaden处开始
iRet = iRet = recv(pDlg->m_socket, pLastBuf+iReaden, iLast, 0) ;
iReaden+=iRet; //已经到达的数据
iLast -= iRet; // 剩余的数据
if(iLast <= 0)
{
break;
}