#include?“pcap.h“
#include?“Analyse.h“
int?n=1;



/*?每次捕獲到數(shù)據(jù)包時，libpcap都會自動調(diào)用這個回調(diào)函數(shù)?*/
void?packet_handler（u_char?*param?const?struct?pcap_pkthdr?*header?const?u_char?*pkt_data）
{

????
????struct?tm?*ltime;
????char?timestr[16];
	time_t?local_tv_sec;
	struct?ether_header?*ether_header;
	int?ether_type;?//協(xié)議類型

???
	printf（“\n*********************************************捕獲第%d個數(shù)據(jù)包******************\n“n）;
	n=n+1;
	
????
/*-------------------------------------------------時間戳顯示------------------------------------------------------------*/

????/*?將時間戳轉(zhuǎn)換成可識別的格式?*/
	local_tv_sec?=?header->ts.tv_sec;
????ltime=localtime（&local_tv_sec）;
????strftime（?timestr?sizeof?timestr?“%H:%M:%S“?ltime）;

????/*?打印數(shù)據(jù)包的時間戳和長度?*/
????printf（“--時間戳%s.?%.6d???len:%d\n\r“?timestr?header->ts.tv_usec?header->len）;


/*--------------------------------------------------數(shù)據(jù)包分析----------------------------------------------------------*/
????
	?printf（“Ethernet?802.3------------------------------------\n\r“）;
	?ether_header=（struct?ether_header?*）pkt_data;

	??printf（“--目的mac地址=%02x:%02x:%02x:%02x:%02x:%02x\n“
????????ether_header->ether_dhost[0]
????????ether_header->ether_dhost[1]
????????ether_header->ether_dhost[2]
????????ether_header->ether_dhost[3]
????????ether_header->ether_dhost[4]
????????ether_header->ether_dhost[5]）;
	?
	?printf（“--源mac地址=%02x:%02x:%02x:%02x:%02x:%02\n“
		ether_header->ether_shost[0]
		ether_header->ether_shost[1]
		ether_header->ether_shost[2]
		ether_header->ether_shost[3]
		ether_header->ether_shost[4]
		ether_header->ether_shost[5]）;

	??ether_type=ntohs（ether_header->ether_type）;
	??printf（“--協(xié)議類型或數(shù)據(jù)長度=%04x“ether_type）;

???switch（ether_type）
	{
	
	case?0x0800:?
		printf（“?（IP協(xié)議）\n\r“）;//IP協(xié)議分析
		ip_Analyse（pkt_data）;
		break;

	
	case?0x0806:?
		printf（“?（ARP協(xié)議）\n\r“）;//ARP協(xié)議分析
		arp_Analyse（pkt_data）;????????
		break;
	
	default:
		printf（“\n\r未知類型數(shù)據(jù)報:0x%0X\n“ether_type）;
		break;
	}
}
unsigned?short?check_sum（unsigned?short?*bufint?nword）????????//首部校驗和的計算
{
	unsigned?long?sum;
	for（sum=0;nword>0;nword--）
	{
		sum+=*buf++;
	}
	sum=（sum>>16）+（sum&0xffff）;
	sum=sum+（sum>>16）;
	if（sum==0xFFFF）
	{
		return?1;
	}
	else
		return?-1;
}

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2012-05-10?10:35??Analyse\
?????文件????????2405??2012-03-23?13:45??Analyse\Analyse.c
?????文件????????3742??2012-03-22?20:47??Analyse\Analyse.h
?????文件??????142336??2012-03-23?19:50??Analyse\Analyse.ncb
?????文件?????????903??2012-03-20?15:47??Analyse\Analyse.sln
?????文件???????10752??2012-03-23?19:50??Analyse\Analyse.suo
?????文件????????3959??2012-03-22?20:32??Analyse\Analyse.vcproj
?????文件????????2071??2012-03-22?14:20??Analyse\arp_Analyse.c
?????目錄???????????0??2012-05-10?10:34??Analyse\Debug\
?????文件??????188416??2012-05-05?13:40??Analyse\Debug\Analyse.exe
?????文件??????513356??2012-03-23?18:17??Analyse\Debug\Analyse.ilk
?????文件??????181209??2012-03-23?13:45??Analyse\Debug\Analyse.obj
?????文件?????4390912??2012-03-23?13:45??Analyse\Debug\Analyse.pch
?????文件?????1551360??2012-03-23?18:17??Analyse\Debug\Analyse.pdb
?????文件??????180996??2012-03-22?20:47??Analyse\Debug\arp_Analyse.obj
?????文件?????????810??2012-03-23?19:37??Analyse\Debug\BuildLog.htm
?????文件??????179283??2012-03-23?18:17??Analyse\Debug\icmp_Analyse.obj
?????文件??????179553??2012-03-23?18:17??Analyse\Debug\igmp_Analyse.obj
?????文件??????185164??2012-03-22?20:47??Analyse\Debug\ip_Analyse.obj
?????文件??????184052??2012-03-23?18:17??Analyse\Debug\tcp_Analyse.obj
?????文件??????178729??2012-03-23?18:17??Analyse\Debug\udp_Analyse.obj
?????文件???????33792??2012-05-10?10:34??Analyse\Debug\vc60.idb
?????文件???????28672??2012-05-10?10:34??Analyse\Debug\vc60.pdb
?????文件??????232448??2012-03-23?18:17??Analyse\Debug\vc70.idb
?????文件??????634880??2012-03-23?18:17??Analyse\Debug\vc70.pdb
?????文件????????1032??2012-03-23?18:17??Analyse\icmp_Analyse.c
?????文件????????1135??2012-03-23?18:17??Analyse\igmp_Analyse.c
?????目錄???????????0??2012-04-10?10:06??Analyse\Include\
?????文件????????3928??2009-10-07?01:20??Analyse\Include\bittypes.h
?????文件????????5756??2009-10-07?01:19??Analyse\Include\ip6_misc.h
?????文件???????16958??2008-11-18?12:26??Analyse\Include\Packet32.h
............此處省略27個文件信息