读取pcap文件,过滤非tcp包,获取IP及tcp端口信息
2012-10-14 23:41
429 查看
来自http://www.cnblogs.com/ErinCodeMM/archive/2011/07/10/2102517.html
// OpenAndFilterAndPres.cpp : Defines the entry point for the console application. // #include "stdafx.h" #include "pcap.h" #include "remote-ext.h" #include"stdlib.h" /* 4 bytes IP address */ typedef struct ip_address{ u_char byte1; u_char byte2; u_char byte3; u_char byte4; }ip_address; /* IPv4 header */ typedef struct ip_header{ u_char ver_ihl; // Version (4 bits) + Internet header length (4 bits) u_char tos; // Type of service u_short tlen; // Total length u_short identification; // Identification u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits) u_char ttl; // Time to live u_char proto; // Protocol u_short crc; // Header checksum ip_address saddr; // Source address ip_address daddr; // Destination address u_int op_pad; // Option + Padding }ip_header; /* UDP header*/ typedef struct udp_header{ u_short sport; // Source port u_short dport; // Destination port u_short len; // Datagram length u_short crc; // Checksum }udp_header; // TCP首部 typedef struct tcp_header{ WORD source_port; // (16 bits) Winsock 内置函数 ntohs(),主要作用将大端转换为小端! WORD destination_port; // (16 bits) Winsock 内置函数 ntohs(),主要作用将大端转换为小端! DWORD seq_number; // Sequence Number (32 bits) 大小端原因,高低位4个8bit的存放顺序是反的,intel使用小端模式 DWORD ack_number; // Acknowledgment Number (32 bits) 大小端原因,高低位4个8bit的存放顺序是反的,intel使用小端模式 WORD info_ctrl; // Data Offset (4 bits), Reserved (6 bits), Control bits (6 bits) intel使用小端模式 WORD window; // (16 bits) WORD checksum; // (16 bits) WORD urgent_pointer; // (16 bits) } tcp_header; /* prototype of the packet handler */ void dispatcher_handler(u_char *temp1, const struct pcap_pkthdr *header, const u_char *pkt_data); int main(int argc, char* argv[]) { pcap_t *fp; char errbuf[PCAP_ERRBUF_SIZE]; char source[PCAP_BUF_SIZE]; //char packet_filter[] = "tcp"; //有tcp必有ip char packet_filter[] = "ip and tcp"; struct bpf_program fcode; u_int netmask; if(argc != 2){ printf("usage: %s filename", argv[0]); return -1; } /* Create the source string according to the new WinPcap syntax */ if ( pcap_createsrcstr( source, // variable that will keep the source string PCAP_SRC_FILE, // we want to open a file NULL, // remote host NULL, // port on the remote host argv[1], // name of the file we want to open errbuf // error buffer ) != 0) { fprintf(stderr,"\nError creating a source string\n"); return -1; } /* Open the capture file */ if ( (fp= pcap_open(source, // name of the device 65536, // portion of the packet to capture // 65536 guarantees that the whole packet will be captured on all the link layers PCAP_OPENFLAG_PROMISCUOUS, // promiscuous mode 1000, // read timeout NULL, // authentication on the remote machine errbuf // error buffer ) ) == NULL) { fprintf(stderr,"\nUnable to open the file %s.\n", source); return -1; } netmask=0xffffff; //compile the filter if (pcap_compile(fp, &fcode, packet_filter, 1, netmask) <0 ) { fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n"); return -1; } //set the filter if (pcap_setfilter(fp, &fcode)<0) { fprintf(stderr,"\nError setting the filter.\n"); return -1; } // read and dispatch packets until EOF is reached pcap_loop(fp, 0, dispatcher_handler, NULL); return 0; } void dispatcher_handler(u_char *temp1, const struct pcap_pkthdr *header, const u_char *pkt_data) { struct tm *ltime; char timestr[16]; ip_header *ih; tcp_header *th; u_int ip_len; u_short sport,dport; time_t local_tv_sec; /* convert the timestamp to readable format */ local_tv_sec = header->ts.tv_sec; ltime=localtime(&local_tv_sec); strftime( timestr, sizeof timestr, "%H:%M:%S", ltime); /* print timestamp and length of the packet */ printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len); /* retireve the position of the ip header */ ih = (ip_header *) (pkt_data + 14); //length of ethernet header /* retireve the position of the tcp header */ //从IPV4首部中取出"首部长度(4 bits)" ip_len = (ih->ver_ihl & 0xf) * 4; //强制类型转换,便于用自己的命名处理 th = (tcp_header *) ((u_char*)ih + ip_len); /* convert from network byte order to host byte order */ sport = ntohs( th->source_port ); dport = ntohs( th->destination_port ); /* print ip addresses and udp ports */ printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n", ih->saddr.byte1, ih->saddr.byte2, ih->saddr.byte3, ih->saddr.byte4, sport, ih->daddr.byte1, ih->daddr.byte2, ih->daddr.byte3, ih->daddr.byte4, dport); }
相关文章推荐
- 读取pcap文件,过滤非tcp包,获取IP及tcp端口信息
- 读取pcap文件,过滤非tcp包,获取IP及tcp端口信息
- C winpcap 网络抓包 并获取IP TCP 协议的相关信息
- java获得U盘根目录、读取图片视频头文件信息、获取视频时长
- 常用公共函数库(验证mac地址、判断ip所属网段、创建文件夹、读取文件、获取移动客户端类型等)
- Eclipse下的Java工程用JavaProject对象获取配置信息(不用读取配置文件)
- 初学python-获取网络设备配置文件接口IP信息
- python读取文件通过正则过滤需要信息然后保存到新文件里
- 读取配置文件获取所需信息
- 读取wav文件头,获取文件详细信息
- ASP.NET获取IP及电脑名等信息的简单方法+通用类文件源码
- 从文件对话框中读取一幅bmp图片,并解析图片信息(eg:获取分辨率)
- java文件之写入,读取,全部删除,获取过滤or获取特定字符串,删除特定字符串方法集合
- 读取xml文件里switch节点的IP和设备信息,ping设备,异常显示在列表里
- java读取txt文件,使用正则表达式获取信息
- ASP.NET获取IP及电脑名等信息的简单方法+通用类文件源码 (转载)
- java Web项目中,利用其过滤功能,实现访问者每次访问服务器时,记录访问者的IP,访问时间,Url等信息,并保存到文件的操作
- ASP.NET获取IP及电脑名等信息的简单方法+通用类文件源码
- PHP文件操作(一)获取文件信息,读取文件
- JAVA之旅(二十八)——File概述,创建,删除,判断文件存在,创建文件夹,判断是否为文件/文件夹,获取信息,文件列表,文件过滤