Winpcap数据包的抓取及还原

winpcap技术手册，除了安装文件里doc文件下有个帮助，这里在给一个：http://www.ferrisxu.com/WinPcap/html/index.html

这里我们用pcap_next_ex 函数抓取到数据包后，我们就要开始提取其中的关键信息了，这里我保存在了pkt_data里，之后又传到了处理函数中

代码如下，我也已经写的很清楚了。其中MAC地址是在数据链路层获取的，其他的诸如端口号，IP等都是通过分析IP包和TCP包获取。

唯一需要注意的就是在定义结构体的时候要注意字节的大小，不然获取的信息就是错误的了。

#include <stdio.h>
#include <iostream>
#define HAVE_REMOTE
#include "pcap.h"
#include "remote-ext.h"

#pragma comment(lib, "Ws2_32.lib")
#pragma comment(lib, "wpcap.lib")

using namespace std;

FILE* fp;

// 以太网协议格式的定义
typedef struct ether_header {
u_char ether_dhost[6];		// 目标地址
u_char ether_shost[6];		// 源地址
u_short ether_type;			// 以太网类型
}ether_header;

// 用户保存4字节的IP地址
typedef struct ip_address {
u_char byte1;
u_char byte2;
u_char byte3;
u_char byte4;
}ip_address;

// 用于保存IPV4的首部
typedef struct ip_header {
#ifdef WORDS_BIGENDIAN
u_char ip_version : 4, header_length : 4;
#else
u_char header_length : 4, ip_version : 4;
#endif

u_char ver_ihl;		// 版本以及首部长度，各4位
u_char tos;			// 服务质量
u_short tlen;		// 总长度
u_short identification;		// 身份识别
u_short offset;			// 分组偏移
u_char ttl;			// 生命周期
u_char proto;		// 协议类型
u_short checksum;		// 包头测验码
ip_address saddr;	// 源IP地址
ip_address daddr;	// 目的IP地址
u_int op_pad;		//可选 填充字段
}ip_header;

// 保存TCP首部
typedef struct tcp_header {
u_short sport;
u_short dport;
u_int sequence;		// 序列码
u_int ack;					// 回复码

#ifdef WORDS_BIGENDIAN
u_char offset : 4, reserved : 4;		// 偏移 预留
#else
u_char reserved : 4, offset : 4;		// 预留 偏移
#endif

u_char flags;				// 标志
u_short windows;			// 窗口大小
u_short checksum;			// 校验和
u_short urgent_pointer;		// 紧急指针
}tcp_header;

typedef struct udp_header {
u_int32_t sport;			// 源端口
u_int32_t dport;			// 目标端口
u_int8_t zero;				// 保留位
u_int8_t proto;				// 协议标识
u_int16_t datalen;			// UDP数据长度
}udp_header;

typedef struct icmp_header {
u_int8_t type;				// ICMP类型
u_int8_t code;				// 代码
u_int16_t checksum;			// 校验和
u_int16_t identification;	// 标识
u_int16_t sequence;			// 序列号
u_int32_t init_time;		// 发起时间戳
u_int16_t recv_time;		// 接受时间戳
u_int16_t send_time;		// 传输时间戳
}icmp_header;

typedef struct arp_header {
u_int16_t arp_hardware_type;
u_int16_t arp_protocol_type;
u_int8_t arp_hardware_length;
u_int8_t arp_protocol_length;
u_int16_t arp_operation_code;
u_int8_t arp_source_ethernet_address[6];
u_int8_t arp_source_ip_address[4];
u_int8_t arp_destination_ethernet_address[6];
u_int8_t arp_destination_ip_address[4];
}arp_header;

void tcp_protocol_packet_handle(
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
struct tcp_header *tcp_protocol;
u_short sport;
u_short dport;
int header_length;
u_short windows;
u_short urgent_pointer;
u_int sequence;
u_int acknowledgement;
u_short checksum;
u_char flags;

printf("===========TCP Protocol===========\n");

tcp_protocol = (struct tcp_header*)(packet_content + 14 + 20);
sport = ntohs(tcp_protocol->sport);
dport = ntohs(tcp_protocol->dport);
header_length = tcp_protocol->offset * 4;
sequence = ntohl(tcp_protocol->sequence);
acknowledgement = ntohl(tcp_protocol->ack);
windows = ntohs(tcp_protocol->windows);
urgent_pointer = ntohs(tcp_protocol->urgent_pointer);
flags = tcp_protocol->flags;
checksum = ntohs(tcp_protocol->checksum);

fprintf(fp, "%d0%d%d%c%d", header_length, sport, dport, flags, windows);

switch(dport) {
default:
break;
}

if(flags & 0x08) printf("PSH");
if(flags & 0x10) printf("ACK");
if(flags & 0x02) printf("SYN");
if(flags & 0x20) printf("URG");
if(flags & 0x01) printf("FIN");
if(flags & 0x04) printf("RST");
printf("\n");
}

void udp_protocol_packet_handle(
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
struct udp_header* udp_protocol;
u_short sport;
u_short dport;
u_short datalen;

udp_protocol = (struct udp_header*)(packet_content + 14 + 20);
sport = ntohs(udp_protocol->sport);
dport = ntohs(udp_protocol->dport);
datalen = ntohs(udp_protocol->datalen);

fprintf(fp, "0%d%d%d",datalen, sport, dport);
}

void arp_protocol_packet_handle(
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
struct arp_header *arp_protocol;
u_short protocol_type;
u_short hardware_type;
u_short operation_code;
u_char hardware_length;
u_char protocol_length;

struct tm* ltime;
char timestr[16];
time_t local_tv_sec;
local_tv_sec = packet_header->ts.tv_sec;
ltime = localtime(&local_tv_sec);
strftime(timestr, sizeof(timestr), "%H:%M:%S", ltime);

printf("--------   ARP协议    --------\n");
arp_protocol = (struct arp_header*)(packet_content + 14);
hardware_type = ntohs(arp_protocol->arp_hardware_type);
protocol_type = ntohs(arp_protocol->arp_protocol_type);
operation_code = ntohs(arp_protocol->arp_operation_code);
hardware_length = arp_protocol->arp_hardware_length;
protocol_length = arp_protocol->arp_protocol_length;

fprintf(fp, "%d%s", protocol_length, timestr);

switch (operation_code)
{
case 1:
printf("ARP请求协议\n");
break;
case 2:
printf("ARP应答协议\n");
break;
case 3:
printf("RARP请求协议\n");
break;
case 4:
printf("RARP应答协议\n");
break;
default:
break;
}
}

void icmp_protocol_packet_handle(
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
struct icmp_header *icmp_protocol;
u_short type;
u_short datalen;
u_int init_time;
u_int recv_time;
u_int send_time;

icmp_protocol = (struct icmp_header*)(packet_content + 14 + 20);
datalen = sizeof(icmp_protocol);
type = icmp_protocol->type;
init_time = icmp_protocol->init_time;
recv_time = icmp_protocol->recv_time;
send_time = icmp_protocol->send_time;

fprintf(fp, "%d%c%d%d%d", datalen, type, init_time, recv_time, send_time);

//	printf("===========ICMP Protocol==========\n");

switch(icmp_protocol->type) {
case 8:
// 回显请求报文
break;
case 0:
// 回显应答报文
break;
default:
break;
}
}

void ip_protocol_packet_handle(
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
struct ip_header *ip_protocol;
u_int header_length;
u_char tos;
u_short checksum;

ip_address saddr;
ip_address daddr;
u_char ttl;
u_short tlen;
u_short identification;
u_short offset;

printf("===========IP Protocol===========\n");

ip_protocol = (struct ip_header*)(packet_content + 14);
header_length = ip_protocol->header_length * 4;
checksum = ntohs(ip_protocol->checksum);
tos = ip_protocol->tos;
offset = ntohs(ip_protocol->offset);

saddr = ip_protocol->saddr;
daddr = ip_protocol->daddr;
ttl = ip_protocol->ttl;
identification = ip_protocol->identification;
tlen = ip_protocol->tlen;
offset = ip_protocol->offset;

fprintf(fp, "%d%d%c%d%d%d", saddr, daddr, ttl, identification, tlen, offset);

switch(ip_protocol->proto) {
case 6:
tcp_protocol_packet_handle(argument, packet_header, packet_content);
break;
case 17:
udp_protocol_packet_handle(argument, packet_header, packet_content);
break;
case 1:
icmp_protocol_packet_handle(argument, packet_header, packet_content);
break;
default:
break;
}
}

void ethernet_protocol_packet_handle (
u_char *argument,
const struct pcap_pkthdr *packet_header,
const u_char *packet_content
) {
u_short ethernet_type;		// 以太网类型
struct ether_header *ethernet_protocol;		// 以太网协议变量
u_char *mac_string;			// 以太网地址

ethernet_protocol = (struct ether_header*)packet_content;		// 获取以太网数据内容
printf("Ethernet type is : \n");
ethernet_type = ntohs(ethernet_protocol->ether_type);	// 获取以太网类型
printf("	%04x\n", ethernet_type);

switch(ethernet_type) {
case 0x0800:
printf("The network layer is IP protocol\n");
break;
case 0x0806:
printf("The network layer is ARP protocol\n");
break;
default:
break;
}

// 获取以太网源地址
//	printf("MAC Source Address is : \n");
mac_string = ethernet_protocol->ether_shost;

fprintf(fp, "%02x:%02x:%02x:%02x:%02x:%02x",
*mac_string,
*(mac_string + 1),
*(mac_string + 2),
*(mac_string + 3),
*(mac_string + 4),
*(mac_string + 5)
);

// 获取以太网目的地址
//	printf("MAC Target Address is : \n");
mac_string = ethernet_protocol->ether_dhost;
fprintf(fp, "%02x:%02x:%02x:%02x:%02x:%02x",
*mac_string,
*(mac_string + 1),
*(mac_string + 2),
*(mac_string + 3),
*(mac_string + 4),
*(mac_string + 5)
);

fprintf(fp, "%d", sizeof(packet_content));

switch(ethernet_type) {
case 0x0800:
ip_protocol_packet_handle(argument, packet_header, packet_content);
break;
default:
break;
}
}

int main() {
pcap_if_t *alldevs;
pcap_if_t *d;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];
int inum;
int i = 0;
u_int netmask;
char packet_filter[] = "ip and tcp";
struct bpf_program fcode;
int res;
struct pcap_pkthdr *header;
struct tm *ltime;
const u_char *pkt_data;
time_t local_tv_sec;
char timestr[16];
ip_header *ih;

// 获得设备列表 pcap_findalldevs_ex()

if(pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1) {
fprintf(stderr, "Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}

for(d = alldevs; d; d = d->next) {
printf("%d. %s", ++i, d->name);
if(d->description) {
printf("(%s)\n", d->description);
}
else {
printf("No description available\n");
}
}

if(0 == i) {
printf("\nNo interface found!Make sure WinPcap is installed\n");
return -1;
}

printf("Enter the interface number(1-%d):", i);
scanf_s("%d", &inum);
if(inum < 1 || inum > i) {
printf("\nInterface number out of range.\n");
pcap_freealldevs(alldevs);
return -1;
}

for(d = alldevs, i = 0; i < inum-1; d=d->next, i++);
// 跳转到该设备，打开适配器

// 设备名，要捕捉的数据包的部分（65536保证能捕获到不同数据链路层上的每个数据包的全部内容），混杂模式，读取超时时间，错误缓冲池
if((adhandle = pcap_open_live(d->name, 65536, 1, 1000, errbuf)) == NULL) {
fprintf(stderr, "\nUnable to open the adapter.%s is not supported by WinPcap\n", errbuf);
pcap_freealldevs(alldevs);
return -1;
}
// 检查数据链路层（只考虑了以太网）
if(pcap_datalink(adhandle) != DLT_EN10MB) {
fprintf(stderr, "\nThis program works only on Ethernet networks.\n");
pcap_freealldevs(alldevs);
return -1;
}

if(d->addresses != NULL) {
// 获得接口的第一个地址的掩码
netmask = ((struct sockaddr_in*)(d->addresses->netmask))->sin_addr.S_un.S_addr;
}
else {
netmask = 0xffffff;
}
/*
// 编译过滤器
if(pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0) {
fprintf(stderr, "\nUnable to compile the packet filter.Check the syntax\n");
pcap_freealldevs(alldevs);
return -1;
}

// 设置过滤器

if(pcap_setfilter(adhandle, &fcode) < 0) {
fprintf(stderr, "\nError setting the filter.\n");
pcap_freealldevs(alldevs);
return -1;
}
printf("\nlistenting on %s...\n", d->description);
*/
fp = freopen("in.txt", "w", stdin);

while((res = pcap_next_ex(adhandle, &header, &pkt_data)) >= 0) {

// 请求超时
if(0 == res) {
continue;
}

// 分析数据包
ethernet_protocol_packet_handle(NULL, header, pkt_data);

// 将时间戳转换成可识别的格式
local_tv_sec = header->ts.tv_sec;
ltime = localtime(&local_tv_sec);
strftime(timestr, sizeof(timestr), "%H:%M:%S", ltime);
ih = (ip_header *)(pkt_data + 14); //以太网头部长度

// 输出时间和IP信息
printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len);

printf("%d.%d.%d.%d -> %d.%d.%d.%d\n",
ih->saddr.byte1,
ih->saddr.byte2,
ih->saddr.byte3,
ih->saddr.byte4,
ih->daddr.byte1,
ih->daddr.byte2,
ih->daddr.byte3,
ih->daddr.byte4);
}

if(-1 == res) {
printf("Error reading the packet:%s\n", pcap_geterr(adhandle));
return -1;
}
pcap_freealldevs(alldevs);

fclose(fp);
fclose(stdin);

return 0;
}