資源簡介
一種基于WinPcap的協(xié)議分析器。能夠監(jiān)聽所有數(shù)據(jù)包，以及監(jiān)聽指定IP地址的數(shù)據(jù)包；能夠顯示完整的IP數(shù)據(jù)包信息，例如，版本、首部長度、數(shù)據(jù)包長度、數(shù)據(jù)包類型（協(xié)議字段）、TTL、源IP地址、目的IP地址等；能夠自動提取FTP的用戶名和密碼；
能夠?qū)⒈O(jiān)聽到的數(shù)據(jù)包信息保存到文件中，以及從文件中讀取并顯示數(shù)據(jù)包信息；具有圖形化操作界面。
代碼片段和文件信息
#include?“stdafx.h“
#include?“Analytical.h“
/*pkt為網(wǎng)絡(luò)中捕獲的包，data為要存為本機(jī)上的數(shù)據(jù)*/
/*分析鏈路層*/
int?analyze_frame（const?u_char?*?pktstruct?datapkt?*?datastruct?pktcount?*npacket）
{
int?i;
struct?ethhdr?*ethh?=?（struct?ethhdr*）pkt;
data->ethh?=?（struct?ethhdr*）malloc（sizeof（struct?ethhdr））;
if（NULL?==?data->ethh）
return?-1;
for（i=0;i<6;i++）
{
data->ethh->dest[i]?=?ethh->dest[i];
data->ethh->src[i]?=?ethh->src[i];
}
npacket->n_sum++;
/*由于網(wǎng)絡(luò)字節(jié)順序原因，需要對*/
data->ethh->type?=?ntohs（ethh->type）;
//處理ARP還是IP包？
switch（data->ethh->type）
{
case?0x0806:
return?analyze_arp（（u_char*）pkt+14datanpacket）;??????//mac?頭大小為14
break;
case?0x0800:
return?analyze_ip（（u_char*）pkt+14datanpacket）;
break;
case?0x86dd:
return?analyze_ip6（（u_char*）pkt+14datanpacket）;
return?-1;
break;
default:
npacket->n_other++;
return?-1;
break;
}
return?1;
}
/*分析網(wǎng)絡(luò)層：ARP*/
int?analyze_arp（const?u_char*?pktdatapkt?*datastruct?pktcount?*npacket）
{
int?i;
struct?arphdr?*arph?=?（struct?arphdr*）pkt;
data->arph?=?（struct?arphdr*）malloc（sizeof（struct?arphdr））;
if（NULL?==?data->arph?）
return?-1;
//復(fù)制IP及MAC
for（i=0;i<6;i++）
{
if（i<4）
{
data->arph->ar_destip[i]?=?arph->ar_destip[i];
data->arph->ar_srcip[i]?=?arph->ar_srcip[i];
}
data->arph->ar_destmac[i]?=?arph->ar_destmac[i];
data->arph->ar_srcmac[i]=?arph->ar_srcmac[i];
}
data->arph->ar_hln?=?arph->ar_hln;
data->arph->ar_hrd?=?ntohs（arph->ar_hrd）;
data->arph->ar_op?=?ntohs（arph->ar_op）;
data->arph->ar_pln?=?arph->ar_pln;
data->arph->ar_pro?=?ntohs（arph->ar_pro）;
strcpy（data->pktType“ARP“）;
npacket->n_arp++;
return?1;
}
/*分析網(wǎng)絡(luò)層：IP*/
int?analyze_ip（const?u_char*?pktdatapkt?*datastruct?pktcount?*npacket）
{
int?i;
struct?iphdr?*iph?=?（struct?iphdr*）pkt;
data->iph?=?（struct?iphdr*）malloc（sizeof（struct?iphdr））;
if（NULL?==?data->iph）
return?-1;
data->iph->check?=?iph->check;
npacket->n_ip++;
/*for（i?=?0;i<4;i++）
{
data->iph->daddr[i]?=?iph->daddr[i];
data->iph->saddr[i]?=?iph->saddr[i];
}*/
data->iph->saddr?=?iph->saddr;
data->iph->daddr?=?iph->daddr;
data->iph->frag_off?=?iph->frag_off;
data->iph->id?=?iph->id;
data->iph->proto?=?iph->proto;
data->iph->tlen?=?ntohs（iph->tlen）;
data->iph->tos?=?iph->tos;
data->iph->ttl?=?iph->ttl;
data->iph->ihl?=?iph->ihl;
data->iph->version?=?iph->version;
//data->iph->ver_ihl=?iph->ver_ihl;
data->iph->op_pad?=?iph->op_pad;
int?iplen?=?iph->ihl*4; //ip頭長度
switch（iph->proto）
{
case?PROTO_ICMP:
return?analyze_icmp（（u_char*）iph+iplendatanpacket）;
break;
case?PROTO_TCP:
return?analyze_tcp（（u_char*）iph+iplendatanpacket）;
break;
case?PROTO_UDP:
return?analyze_udp（（u_char*）iph+iplendatanpacket）;
break;
default?:
return-1;
break;
}
return?1;
}
/*分析網(wǎng)絡(luò)層：IPV6*/
int?analyze ?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????文件????????252??2012-12-13?12:33??WinShark_v3_1\Debug\SavedData\20121213?123259.lix
?????文件???????9524??2012-12-13?12:33??WinShark_v3_1\Debug\SavedData\20121213?123333.lix
?????文件???????5208??2012-12-13?12:51??WinShark_v3_1\Debug\SavedData\20121213?125059.lix
?????文件???????5278??2012-12-13?12:51??WinShark_v3_1\Debug\SavedData\20121213?125130.lix
?????文件???????5199??2012-12-13?12:53??WinShark_v3_1\Debug\SavedData\20121213?125344.lix
?????文件???????5354??2012-12-13?12:57??WinShark_v3_1\Debug\SavedData\20121213?125742.lix
?????文件???????7675??2012-12-13?20:22??WinShark_v3_1\Debug\SavedData\20121213?201521.lix
?????文件???????5835??2012-12-13?20:23??WinShark_v3_1\Debug\SavedData\20121213?202258.lix
?????文件??????20103??2012-12-13?20:23??WinShark_v3_1\Debug\SavedData\20121213?202318.lix
?????文件???????1061??2012-12-13?20:23??WinShark_v3_1\Debug\SavedData\20121213?202340.lix
?????文件???????3230??2012-12-13?20:24??WinShark_v3_1\Debug\SavedData\20121213?202359.lix
?????文件??????13243??2012-12-13?20:24??WinShark_v3_1\Debug\SavedData\20121213?202448.lix
?????文件?????219136??2012-12-14?00:45??WinShark_v3_1\Debug\WinShark_v3_1.exe
?????文件????1429460??2012-12-14?00:45??WinShark_v3_1\Debug\WinShark_v3_1.ilk
?????文件????6204416??2012-12-14?00:45??WinShark_v3_1\Debug\WinShark_v3_1.pdb
?????文件???89063424??2012-12-13?23:10??WinShark_v3_1\ipch\winshark_v3_1-d82ef4ba\winshark_v3_1-c150478b.ipch
?????文件???????7647??2012-12-11?20:34??WinShark_v3_1\WinShark_v3_1\Analytical.cpp
?????文件???????1253??2012-12-11?20:34??WinShark_v3_1\WinShark_v3_1\Analytical.h
?????文件??????20083??2012-12-13?20:10??WinShark_v3_1\WinShark_v3_1\Debug\Analytical.obj
?????文件???????4054??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\cl.command.1.tlog
?????文件??????76790??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\CL.read.1.tlog
?????文件???????3516??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\CL.write.1.tlog
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
?????文件??????????2??2012-12-14?00:45??WinShark_v3_1\WinShark_v3_1\Debug\li
............此處省略233個文件信息
評論
共有 條評論
川公網(wǎng)安備 51152502000135號