Recvpack.rar_ARP UDP_UDP协议数据包_recvpack

#include "pcap.h" #include "stdlib.h" #include "HyrRecvPack.h" #include "stdio.h" //下面是分析TCP协议的函数,其定义方式与回调函数相同 void tcp_packet_callback(u_char *packet, const struct pcap_pkthdr *packet_header, const u_char *packet_content) { struct tcp_header *tcp_protocol; /* TCP协议变量 */ u_char flags; /* 标记 */ int header_length; /* 长度 */ tcp_protocol = (struct tcp_header*)(packet_content + 14+20);/* 获得TCP协议内容 */ header_length = tcp_protocol->tcp_offset *4; /* 长度 */ flags = tcp_protocol->tcp_flags; /* 标识 */ printf("------- TCP协议 -------\n"); printf("源端口号:%d\n", ntohs(tcp_protocol->tcp_source_port)); printf("目的端口号:%d\n", ntohs(tcp_protocol->tcp_destination_port)); switch (ntohs(tcp_protocol->tcp_destination_port)) { case 80: printf("上层协议为HTTP协议\n"); break; case 21: printf("上层协议为FTP协议\n"); break; case 23: printf("上层协议为TELNET协议\n"); break; case 25: printf("上层协议为SMTP协议\n"); break; case 110: printf("上层协议POP3协议\n"); break; default: break; } printf("序列码:%u\n", ntohl(tcp_protocol->tcp_sequence_hyrloveyou)); printf("确认号:%u\n", ntohl(tcp_protocol->tcp_acknowledgement)); printf("首部长度:%d\n", header_length); printf("保留:%d\n", tcp_protocol->tcp_reserved); printf("标记:"); if (flags &0x08) printf("PSH "); if (flags &0x10) printf("ACK "); if (flags &0x02) printf("SYN "); if (flags &0x20) printf("URG "); if (flags &0x01) printf("FIN "); if (flags &0x04) printf("RST "); printf("\n"); printf("窗口大小:%d\n", ntohs(tcp_protocol->tcp_windows)); printf("校验和:%d\n", ntohs(tcp_protocol->tcp_checksum)); printf("紧急指针:%d\n", tcp_protocol->tcp_flags); } //实现UDP协议分析的回调函数 void udp_packet_callback(u_char *packet, const struct pcap_pkthdr *packet_header, const u_char *packet_content) { struct udp_header *udp_protocol; /* UDP协议变量 */ u_short source_port; /* 源端口 */ u_short destination_port; /* 目的端口号 */ u_short length; udp_protocol = (struct udp_header*)(packet_content + 14+20);/* 获得UDP协议内容 */ source_port = ntohs(udp_protocol->udp_source_port); /* 获得源端口 */ destination_port = ntohs(udp_protocol->udp_destination_port);/* 获得目的端口 */ length = ntohs(udp_protocol->udp_length); /* 获得长度 */ printf("---------- UDP协议 ----------\n"); printf("源端口号:%d\n", source_port); printf("目的端口号:%d\n", destination_port); switch (destination_port) { case 20: printf("上层协议为文件传输服务\n"); break; case 25: printf("上层协议为简单邮件传输服务\n"); break; case 57: printf("上层协议为邮件传输服务n"); break; case 53: printf("上层协议为域名系统服务\n"); break; default: break; } printf("长度:%d\n", length); printf("校验和:%d\n", ntohs(udp_protocol->udp_checksum)); } //实现ARP协议分析的回调函数 void arp_packet_callback(u_char *packet, const struct pcap_pkthdr *packet_header, const u_char *packet_content) { struct arp_header *arp_protocol; /* arp协议变量 */ u_short protocol_type; /* arp协议类型 */ u_short hardware_type; /* 硬件类型 */ u_short operation_code; /* 操作码 */ u_char *s_mac_string; /*源以太网地址*/ u_char *d_mac_string; /* 目的以太网地址*/ struct in_addr source_ip_address; /* 源IP地址 */ struct in_addr destination_ip_address; /* 目的IP地址 */ u_char hardware_length; /* 硬件地址长度 */ u_char protocol_length; /* 协议地址长度 */ printf("-------- ARP协议 --------\n"); arp_protocol = (struct arp_header*)(packet_content + 14); hardware_type = ntohs(arp_protocol->arp_hardware_type); printf("硬件类型:%d\n", hardware_type); protocol_type = ntohs(arp_protocol->arp_protocol_type); printf("协议类型:%d\n", protocol_type); hardware_length = arp_protocol->arp_hardware_length; printf("硬件地址长度:%d\n", hardware_length); protocol_length = arp_protocol->arp_protocol_length; printf("协议地址长度:%d\n", protocol_length); operation_code = ntohs(arp_protocol->arp_operation_code); printf("ARP 操作码:%d\n", operation_code); switch (operation_code) { case 1: printf("ARP请求协议\n"); break; case 2: printf("ARP应答协议\n"); break; case 3: printf("RARP请求协议\n"); break; case 4: printf("RARP应答协议\n"); break; default: break; } printf("源以太网地址: "); s_mac_string = arp_protocol->arp_source_ethernet_address; printf("%02x:%02x:%02x:%02x:%02x:%02x\n", *s_mac_string, *(s_mac_string + 1), *(s_mac_string + 2), *(s_mac_string + 3), *(s_mac_string + 4), *(s_mac_string + 5)); memcpy((void*) &source_ip_address, (void*) &arp_protocol->arp_source_ip_address, sizeof(struct in_addr)); printf("源IP地址:%s\n", inet_ntoa(source_ip_address)); printf("目的以太网地址: "); d_mac_string = arp_protocol->arp_destination_ethernet_address; printf("%02x:%02x:%02x:%02x:%02x:%02x\n", *d_mac_string, *(d_mac_string + 1), *(d_mac_string + 2), *(d_mac_string + 3), *(d_mac_string + 4), *(d_mac_string + 5)); memcpy((void*) &destination_ip_address, (void*) &arp_protocol->arp_destination_ip_address, sizeof(struct in_addr)); printf("目的IP地址:%s\n", inet_ntoa(destination_ip_address)); } //实现IP协议分析的回调函数 void ip_packet_callback(u_char *packet, const struct pcap_pkthdr *packet_header, const u_char *packet_content) { struct ip_header *ip_protocol; /* IP协议变量 */ u_int header_length; /* 长度 */ u_int offset; /* 偏移 */ u_char tos; /* 服务质量 */ u_int16_t checksum; /* 校验和 */ ip_protocol = (struct ip_header*)(packet_content + 14); /* 获得IP协议内容 */ checksum = ntohs(ip_protocol->ip_checksum); /* 获得校验和 */ header_length = ip_protocol->ip_header_length *4; /* 获得长度 */ tos = ip_protocol->ip_tos; /* 获得服务质量 */ offset = ntohs(ip_protocol->ip_off); /* 获得偏移 */ printf("----------- IP协议 -----------\n"); printf("版本号:%d\n", ip_protocol->ip_version); printf("首部长度:%d\n", header_length); printf("服务质量:%d\n", tos); printf("总长度:%d\n", ntohs(ip_protocol->ip_length)); printf("标识:%d\n", ntohs(ip_protocol->ip_id)); printf("偏移:%d\n", (offset &0x1fff) *8); printf("生存时间:%d\n", ip_protocol->ip_ttl); printf("协议类型:%d\n", ip_protocol->ip_protocol); switch (ip_protocol->ip_protocol) { case 6: printf("上层协议为TCP协议\n"); break; case 17: printf("上层协议为UDP协议\n"); break; case 1: printf("上层协议为ICMP协议ICMP\n"); break; default: break; } printf("校验和:%d\n", checksum); printf("源IP地址:%s\n", inet_ntoa(ip_protocol->ip_souce_address)); /* 获得源IP地址 */ printf("目的IP地址:%s\n", inet_ntoa(ip_protocol->ip_destination_address)); /* 获得目的IP地址 */ switch (ip_protocol->ip_protocol) /* 根据IP协议判断上层协议 */ { case 6: tcp_packet_callback(packet, packet_header, packet_content); /* 上层协议是TCP协议，调用分析TCP协议的函数 */