C语言实现的网卡监控抓包代码

#define _CRT_SECURE_NO_WARNINGS #include <stdio.h> #include <WinSock2.h> #include <WS2tcpip.h> #include <stdlib.h> #include <Windows.h> #include <string.h> #define MAX_RECEIVEBYTE 255 #define MAX_ADDR_LEN 32 #define MY_IP "127.0.0.1" #define SIO_RCVALL (IOC_IN|IOC_VENDOR|1)//定义网卡为混杂模式 #pragma comment(lib,"Ws2_32.lib") typedef struct ip_hdr//定义IP首部 { unsigned char h_verlen;//4位首部长度，4位IP版本号 unsigned char tos;//8位服务类型TOS unsigned short tatal_len;//16位总长度 unsigned short ident;//16位标示 unsigned short frag_and_flags;//偏移量和3位标志位 unsigned char ttl;//8位生存时间TTL unsigned char proto;//8位协议（TCP,UDP或其他） unsigned short checksum;//16位IP首部检验和 unsigned int sourceIP;//32位源IP地址 unsigned int destIP;//32位目的IP地址 }IPHEADER; typedef struct tsd_hdr//定义TCP伪首部 { unsigned long saddr;//源地址 unsigned long daddr;//目的地址 char mbz; char ptcl;//协议类型 unsigned short tcpl;//TCP长度 }PSDHEADER; typedef struct tcp_hdr//定义TCP首部 { unsigned short sport;//16位源端口 unsigned short dport;//16位目的端口 unsigned int seq;//32位序列号 unsigned int ack;//32位确认号 unsigned char lenres;//4位首部长度/6位保留字 unsigned char flag;//6位标志位 unsigned short win;//16位窗口大小 unsigned short sum;//16位检验和 unsigned short urp;//16位紧急数据偏移量 }TCPHEADER; typedef struct udp_hdr//定义UDP首部 { unsigned short sport;//16位源端口 unsigned short dport;//16位目的端口 unsigned short len;//UDP 长度 unsigned short cksum;//检查和 }UDPHEADER; typedef struct icmp_hdr//定义ICMP首部 { unsigned short sport; unsigned short dport; unsigned char type; unsigned char code; unsigned short cksum; unsigned short id; unsigned short seq; unsigned long timestamp; }ICMPHEADER; int main(int argc, char **argv) { SOCKET sock, sen_sock; WSADATA wsd; char recvBuf[8192] = { 0 }; char sendBuf[8192] = { 0 }; char temp[8192] = { 0 }; DWORD dwBytesRet; int i; int pCount = 0; unsigned int optval = 1; unsigned char* dataip = NULL; unsigned char* datatcp = NULL; unsigned char* dataudp = NULL; unsigned char* dataicmp = NULL; int lentcp, lenudp, lenicmp, lenip; char TcpFlag[6] = { 'F', 'S', 'R', 'A', 'U' };//定义TCP标志位 //--------------------------------------------// //设置为管理员权限 //SHELLEXECUTEINFO sei = { sizeof(SHELLEXECUTEINFO) }; //sei.lpVerb = TEXT("runas"); //sei.lpFile = TEXT("cmd.exe"); //sei.nShow = SW_SHOWNORMAL; //--------------------------------------------// WSAStartup(MAKEWORD(2, 1), &wsd); if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) == SOCKET_ERROR)//创建一个原始套接字 { exit(0); } //char FAR name[MAXBYTE]; //gethostname(name, MAXBYTE); //struct hostent FAR* pHostent; //pHostent = (struct hostent*)malloc(sizeof(struct hostent)); //pHostent = gethostbyname(name); SOCKADDR_IN sa; sa.sin_family = AF_INET; sa.sin_port = htons(1); sa.sin_addr.s_addr = inet_addr(MY_IP); //memcpy(&sa.sin_addr,pHostent->h_addr_list[0],pHostent->h_length);//设置本机地址 bind(sock, (SOCKADDR*)&sa, sizeof(sa));//绑定 if (WSAGetLastError() == 10013) { exit(0); } //设置网卡为混杂模式，也叫泛听模式。可以侦听经过的所有的包。 WSAIoctl(sock, SIO_RCVALL, &optval, sizeof(optval), NULL, 0, &dwBytesRet,NULL,NULL); UDPHEADER * pUdpheader;//UDP头结构体指针 IPHEADER * pIpheader;//IP头结构体指针 TCPHEADER * pTcpheader;//TCP头结构体指针 ICMPHEADER * pIcmpheader;//ICMP头结构体指针 char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];//源IP和目的IP SOCKADDR_IN saSource, saDest;//源地址结构体，目的地址结构体 pIpheader = (IPHEADER*)recvBuf; pTcpheader = (TCPHEADER*)(recvBuf + sizeof(IPHEADER)); pUdpheader = (UDPHEADER*)(recvBuf + sizeof(IPHEADER)); pIcmpheader = (ICMPHEADER*)(recvBuf + sizeof(IPHEADER)); int iIphLen = sizeof(unsigned long)*(pIpheader->h_verlen & 0x0f); while (1) { memset(recvBuf, 0, sizeof(recvBuf)); recv(sock, recvBuf, sizeof(recvBuf), 0); saSource.sin_addr.s_addr = pIpheader->sourceIP; strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN); saDest.sin_addr.s_addr = pIpheader->destIP; strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN); lenip = ntohs(pIpheader->tatal_len); lentcp = ntohs(pIpheader->tatal_len) - (sizeof(IPHEADER) + sizeof(TCPHEADER)); lenudp = ntohs(pIpheader->tatal_len) - (sizeof(IPHEADER) + sizeof(UDPHEADER)); lenicmp = ntohs(pIpheader->tatal_len) - (sizeof(IPHEADER) + sizeof(ICMPHEADER)); if (pIpheader->proto == IPPROTO_TCP&&lentcp != 0 && ntohs(pTcpheader->dport) == 811) { pCount++; dataip = (unsigned char *)recvBuf; datatcp = (unsigned char *)recvBuf + sizeof(IPHEADER) + sizeof(TCPHEADER); //system("cls"); printf("\n#################数据包[%i]=%d字节数据#############", pCount, lentcp); printf("\n**********IP协议头部***********"); printf("\n标示：%i", ntohs(pIpheader->ident)); printf("\n总长度：%i", ntohs(pIpheader->tatal_len)); printf("\n偏移量：%i", ntohs(pIpheader->frag_and_flags)); printf("\n生存时间：%d",pIpheader->ttl); printf("\n服务类型：%d",pIpheader->tos); printf("\n协议类型：%d",pIpheader->proto); printf("\n检验和：%i", ntohs(pIpheader->checksum)); printf("\n源IP：%s", szSourceIP); printf("\n目的IP：%s", szDestIP); printf("\n**********TCP协议头部***********"); printf("\n源端口：%i", ntohs(pTcpheader->sport)); printf("\n目的端口：%i", ntohs(pTcpheader->dport)); printf("\n序列号：%i", ntohs(pTcpheader->seq)); printf("\n应答号：%i", ntohs(pTcpheader->ack)); printf("\n检验和：%i", ntohs(pTcpheader->sum)); printf("\n标志位："); unsigned char FlagMask = 1; int k; //打印标志位 for (k = 0; k < 6; k++) { if ((pTcpheader->flag)&FlagMask) printf("%c", TcpFlag[k]); else printf(" "); FlagMask = FlagMask << 1; } //打印出前100个字节的十六进制数据 printf("\n数据：\n"); for ( i = 0; i < 100; i++) { printf("%x", datatcp[i]); } } if (pIpheader->proto == IPPROTO_UDP&&lenudp != 0 && ntohs(pTcpheader->dport) == 811) { pCount++; dataip = (unsigned char *)recvBuf; dataudp = (unsigned char *)recvBuf + sizeof(IPHEADER) + sizeof(UDPHEADER); printf("\n#################数据包[%i]=%d字节数据#############", pCount, lenudp); printf("\n**********IP协议头部***********"); printf("\n标示：%i", ntohs(pIpheader->ident)); printf("\n总长度：%i", ntohs(pIpheader->tatal_len)); printf("\n偏移量：%i", ntohs(pIpheader->frag_and_flags)); printf("\n生存时间：%d",pIpheader->ttl); printf("\n服务类型：%d",pIpheader->tos); printf("\n协议类型：%d",pIpheader->proto); printf("\n检验和：%i", ntohs(pIpheader->checksum)); printf("\n源IP：%s", szSourceIP); printf("\n目的IP：%s", szDestIP); printf("\n**********UDP协议头部***********"); printf("\n源端口：%i", ntohs(pUdpheader->sport)); printf("\n目的端口：%i", ntohs(pUdpheader->dport)); printf("\nUDP 长度：%i", ntohs(pUdpheader->len)); printf("\n检验和：%i", ntohs(pUdpheader->cksum)); } //+++++++++++++++++++++++++++++ //在这里可以加入其它封包的判断和处理 //+++++++++++++++++++++++++++++ } }