Winpcap 在C下的报文分析

#pragma comment(lib,"wsock32.lib") #include <stdio.h> #include <pcap.h> #include <stdlib.h> #include <malloc.h> #include <string> /*包含一些字符串处理函数的头文件*/ using namespace std; struct ip_link //定义链表 { struct ip_link *next; struct ip_link *prror; unsigned int id; unsigned long source_ip; unsigned long dest_ip; unsigned int ip_mask; }; struct In_ip_link { struct In_ip_link *in_next; struct In_ip_link *in_prror; unsigned long in_ip; unsigned int id; unsigned int in_mask; }; struct Out_ip_link { struct Out_ip_link *out_next; struct Out_ip_link *out_prror; unsigned long out_ip; unsigned int out_mask; }; struct in_ip_unite_link { struct in_ip_unite_link *u_next; struct in_ip_unite_link *u_prror; unsigned long iu_ip; unsigned int iu_mask; }; struct out_ip_unite_link { struct out_ip_unite_link *u_next; struct out_ip_unite_link *u_prror; unsigned long ou_ip; unsigned int ou_mask; }; int creat_link(unsigned long sourceip, unsigned long destip, unsigned int ipmask, struct ip_link** tail) //创建链表 { struct ip_link* node = NULL; node=(struct ip_link*)malloc(sizeof(struct ip_link)); if(NULL != node) { node->source_ip=sourceip; node->dest_ip=destip; node->ip_mask=ipmask; node->prror=(*tail); (*tail)->next=node; node->next=NULL; (*tail)=(*tail)->next; //printf("%x,%x,%d",node->source_ip,node->dest_ip,node->ip_mask); } return 1; } unsigned long long ip_exchange(unsigned int ip) { unsigned long long a,b,c,d,ex_ip; /*printf("mask_temp=\n",mask_temp);*/ a=ip&0xff; a=a<<24; b=ip&0xff00; b=b<<8; c=ip&0xff0000; c=c>>8; d=ip&0xff000000; d=d>>24; ex_ip=a|b|c|d; return ex_ip; } int ip_mask(unsigned long long mask_temp) //此函数用来求区分源IP与目的IP的相对掩码 { unsigned long long a,b,c,d; unsigned int mask_k; unsigned int j; /*printf("mask_temp=\n",mask_temp);*/ a=mask_temp&0xff; a=a<<24; b=mask_temp&0xff00; b=b<<8; c=mask_temp&0xff0000; c=c>>8; d=mask_temp&0xff000000; d=d>>24; mask_temp=a|b|c|d; for(j=1;j<=32;j++) //求sourceip与destip的相对掩码 { mask_temp=mask_temp>>1; if(mask_temp==1) { mask_k=32-j; /*printf("mask_k=%d\n",mask_k); getchar();*/ break; } else if(mask_temp==0) mask_k=32; } return mask_k; } int In_Insert_link(unsigned long ip,unsigned int mask,unsigned int id,struct In_ip_link** in_tail) { struct In_ip_link* in_node = NULL; in_node=(struct In_ip_link*)malloc(sizeof(struct In_ip_link)); //printf("in insert:::%x:%x\n",ip,mask); if(NULL != in_node) { in_node->in_ip=ip; in_node->in_mask=mask; in_node->id; in_node->in_prror=(*in_tail); in_node->in_next=NULL; (*in_tail)->in_next=in_node; (*in_tail)=(*in_tail)->in_next; /*printf("%x,%d",in_node->in_ip,in_node->in_mask);*/ } return 1; } int Out_Insert_link(unsigned long ip,unsigned int mask,struct Out_ip_link** out_tail) { struct Out_ip_link* out_node = NULL; out_node=(struct Out_ip_link*)malloc(sizeof(struct Out_ip_link)); //printf("out insert:::%x:%x\n",ip,mask); if(NULL != out_node) { out_node->out_ip=ip; out_node->out_mask=mask; out_node->out_prror=(*out_tail); out_node->out_next=NULL; (*out_tail)->out_next=out_node; (*out_tail)=(*out_tail)->out_next; } return 1; } void main() { struct ip_link* head; //存储IP的链表头 struct ip_link* pr; unsigned int id=-1; head=(struct ip_link*)malloc(sizeof(struct ip_link)); head->prror=NULL; head->next=head; pr=head; struct pcap_pkthdr *header; const u_char *pkt_data; typedef struct pcap pcap_t; pcap_t *fp1; //文件指针 char errbuf[PCAP_ERRBUF_SIZE]; const char *fname; int res; FILE *fp; //保存文件指针 /*打开pcap文件，并得到文件中所有的源和目的IP， 并求出源和目的IP的相对掩码，输出到文件temp.txt中*/ if((fp1 = pcap_open_offline("111.pcap",errbuf)) == NULL) //打开已有的pcap文件 { fprintf(stderr,"\n Error opening pcap file\n"); return ; } while((res = pcap_next_ex(fp1,&header,&pkt_data))>=0) //循环读取每条报文的源与目的IP，并存进ip_link链表 { unsigned long long mask; unsigned long j; unsigned int k; unsigned int sourceip; unsigned int destip; unsigned int nbss; unsigned char pro1,pro2,pro3; pro1=*(char*) (pkt_data +12); pro2=*(char*) (pkt_data +13); pro3=*(char*) (pkt_data +23); sourceip=*(int *) (pkt_data +26); //源IP destip=*(int *) (pkt_data +30); //目的IP nbss=*(int*) (pkt_data +58); /*printf("nbss=%d",nbss); getchar(); printf("pro1=%d,pro2=%d\n",pro1,pro2); printf("sourceip=%d,destip=%d\n",sourceip,destip); printf("sourceip=%x,destip=%x\n",sourceip,destip); getchar();*/ if(pro1==8 && pro2==0 && pro3!=1) { /*for(j=1;j<9999999;j++) { printf("por3=:::%d id=:::%d\n",pro3,j); if(pro3==1) getchar(); }*/ /*printf("pro1=%d,pro2=%d\n",pro1,pro2);*/ mask=sourceip^destip; k=ip_mask(mask); if(nbss == 1112364031) { int i=0; /*int a[3]; a[0]=8; a[1]=16; a[2]=24;*/ /*printf("a[%d]=::::%d",i,a[i]); getchar();*/ unsigned long long exc_sourceip; unsigned long long exc_destip; exc_sourceip=ip_exchange(sourceip); exc_destip=ip_exchange(destip); int j; /*printf("exc_sourceip=%x exc_destip=%x\n",exc_sourceip,exc_destip);*/ for(j=0;j<16;j++) { /*printf("j=:::,%d\n",j);*/ exc_sourceip=exc_sourceip>>1; /*printf("exc_sourceip=:::%x\n",exc_sourceip); printf("exc_sourceip=%x\n",exc_sourceip); getchar();*/ } for(j=0;j<16;j++) { /*printf("j=:::,%d\n",j);*/ exc_destip=exc_destip>>1; /*printf("exc_destip=:::%x\n",exc_destip); printf("exc_destip=%x\n",exc_destip); getchar();*/ } if(exc_sourceip != exc_destip) creat_link(sourceip,destip,k,&pr); } else { creat_link(sourceip,destip,k,&pr); /*printf("pr222=:::%x,%x\n",pr->source_ip,pr->dest_ip);*/ } } else continue; } /*pr=head->next; while(pr->next!=NULL){ printf("head::%x:%x:%d\n",pr->source_ip,pr->dest_ip,pr->ip_mask); pr=pr->next; }*/ /*printf("id=%d",id); getchar();*/ /*ip_link* ff=head->next; while(ff!=NULL) { printf("%x,%x,%d",ff->source_ip,ff->dest_ip,ff->ip_mask); ff=ff->next; getchar(); }*/ struct ip_link* f_ip; struct ip_link* s_ip; struct ip_link* f_s_ip; f_ip=head->next; s_ip=head->next; f_s_ip=head->next; unsigned long long mask_temp1; unsigned long long mask_temp2; unsigned long long mask_temp3; unsigned long long mask_temp4; unsigned int mask[4]; unsigned int mask_max=0; unsigned int max[100]; unsigned int sw; unsigned int j,mm,ch; unsigned int mask_num=0; struct In_ip_link* in_head;/**tta,*ttb*/ //存储内网IP的链表头 struct In_ip_link* in_pr; in_head=(struct In_ip_link*)malloc(sizeof(struct In_ip_link)); in_head->in_prror=NULL; in_head->in_next=in_head; in_pr=in_head; struct Out_ip_link* out_head; //存储外网IP的链表头 struct Out_ip_link* out_pr; out_head=(struct Out_ip_link*)malloc(sizeof(struct Out_ip_link)); out_head->out_prror=NULL; out_head->out_next=out_head; out_pr=out_head; In_Insert_link(f_ip->source_ip,f_ip->ip_mask,id,&in_pr); id++; Out_Insert_link(f_ip->dest_ip,f_ip->ip_mask,&out_pr); /*struct In_ip_link* aa; aa=in_head->in_next; while(aa!=NULL) { printf("aa=%x,%d\n",aa->in_ip,aa->in_mask); aa=aa->in_next; getchar(); }*/ f_ip=f_ip->next; struct In_ip_link* in_p; struct Out_ip_link* out_p; in_p=in_head->in_next; out_p=out_head->out_next; while(f_ip!=NULL && in_p!=NULL) { /*printf("f_ip=::::%x,%x,%d\n",f_ip->source_ip,f_ip->dest_ip,f_ip->ip_mask); printf("in_p=::::%x,%d id=%d out_p=::::%x,%d",in_p->in_ip,in_p->in_mask,id,out_