基于PHP+MYSQL实现的网络数据包分析工具的设计与开发(源代码+论文)

#include<stdio.h> #include<string.h> #include<stdlib.h> #include"mysql.h" #include<time.h> char *ipaddr=NULL; char *macaddr=NULL; int ipnum,syn,fin,port; extern st,et; void select_data(MYSQL mysql) { // MYSQL mysql; MYSQL_RES *result; MYSQL_ROW row; int res; int count,numRecords; //char * str="192:168:0:1"; //mysql_init(&mysql);//数据库初始化 // if(!(mysql_real_connect(&mysql,"localhost","root","159753","packet",0,NULL,0)))//连接数据库 // printf("Could not connect to MySQL server!\n"); res = mysql_query(&mysql,"SELECT * FROM porder");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!!!!!\n"); } else { numRecords=mysql_num_rows(result); for(count=0;count<numRecords;count++) { row=mysql_fetch_row(result); ipaddr=&row[0]; macaddr=&row[1]; ipnum=atoi(row[2]); syn=atoi(row[3]); fin=atoi(row[4]); port=atoi(row[5]); } } //printf("%d",port); mysql_free_result(result); //mysql_close(&mysql);//关闭数据库 } void packet_dis(MYSQL mysql) { //MYSQL mysql; MYSQL_RES *result; MYSQL_ROW row; int res; int n=0,m=0,l=0,w=0; int count,numRecords; //void syn_flood(); //char * str="192:168:0:1"; FILE *fp; fp=fopen("/var/www/apache2-default/result.html","a"); //mysql_init(&mysql);//数据库初始化 //if(!(mysql_real_connect(&mysql,"localhost","root","159753","packet",0,NULL,0)))//连接数据库 //printf("Could not connect to MySQL server!\n"); res = mysql_query(&mysql,"SELECT packetnumber FROM ether");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); m=numRecords; fprintf(fp,"程序捕获数据包：%d 个，",numRecords); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT packetnumber FROM arp");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fprintf(fp,"其中ARP数据包：%d 个，",numRecords); if(m>100&&((float)numRecords/m)>0.3) fputs("ARP包数量过多！",fp); else fputs("ARP包数量正常！",fp); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT packetnumber FROM ip");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fprintf(fp,"IP数据包：%d 个 。",numRecords); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT packetnumber FROM icmp");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fprintf(fp,"在这些IP包中ICMP数据包：%d 个，",numRecords); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT packetnumber FROM tcp");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fprintf(fp,"TCP数据包：%d 个，",numRecords); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT packetnumber FROM udp");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fprintf(fp,"UDP数据包：%d 个，",numRecords); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT flag,count(*) FROM dns GROUP BY flag");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); for(count=0;count<numRecords;count++) { row=mysql_fetch_row(result); if(atoi(row[0])==0) { fprintf(fp,"发送DNS请求：%d 个,",atoi(row[1])); l=atoi(row[1]); } else { fprintf(fp,"接收DNS应答：%d 个。",atoi(row[1])); w=atoi(row[1]); } } if(l>50&&((float)l/(l+w))>0.9) fprintf(fp,"DNS请求多没有回应，请监测DNS服务器，或网络问题！"); } mysql_free_result(result); res = mysql_query(&mysql,"SELECT op,count(*) FROM dhcp GROUP BY op");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); for(count=0;count<numRecords;count++) { row=mysql_fetch_row(result); if(strcmp(row[0],"boot request")==0) { fprintf(fp,"发送DHCP请求：%d 个。",atoi(row[1])); l=atoi(row[1]); } else { fprintf(fp,"接收DHCP应答：%d 个,",atoi(row[1])); w=atoi(row[1]); } } if(m>100&&((float)(l+w)/m)>0.15) fputs("DHCP包数量过多！",fp); if(l>5&&((float)l/(l+w))>0.8) fputs("DHCP请求过多无响应，可能DHCP服务器出问题！",fp); else fputs("DHCP包数量正常！",fp); } mysql_free_result(result); //mysql_close(&mysql);//关闭数据库 fputs("<br>",fp); fclose(fp); //syn_flood(); } void arp_bam(MYSQL mysql) { // MYSQL mysql; MYSQL_RES *result; MYSQL_ROW row; int res; int n=0; int count,numRecords; //void syn_flood(); //char * str="192:168:0:1"; FILE *fp; fp=fopen("/var/www/apache2-default/result.html","a"); // mysql_init(&mysql);//数据库初始化 //if(!(mysql_real_connect(&mysql,"localhost","root","159753","packet",0,NULL,0)))//连接数据库 // printf("Could not connect to MySQL server!\n"); res = mysql_query(&mysql,"SELECT sha FROM arp WHERE spa='192:168:0:1'");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); for(count=0;count<numRecords;count++) { row=mysql_fetch_row(result); if(!row[0]=="0:50:56:c0:0:1") n=n++; } fputs("<br>",fp); //fprintf(fp,"ARP错误率：%f ",n/numRecords); if((float)n/numRecords>0.2) fprintf(fp,"对比网关IP与ARP,ARP错误率：%f,主机可能受到ARP攻击！\n",(float)n/numRecords); else fprintf(fp,"对比网关IP与ARP,ARP错误率：%f,ARP数据正常！\n",(float)n/numRecords); } mysql_free_result(result); //mysql_close(&mysql);//关闭数据库 //syn_flood(); fclose(fp); } void ddos(MYSQL mysql) { //MYSQL mysql; MYSQL_RES *result; //MYSQL_ROW row; int res; int numRecords; //char * str="192:168:0:1"; FILE *fp; fp=fopen("/var/www/apache2-default/result.html","a"); //mysql_init(&mysql);//数据库初始化 // if(!(mysql_real_connect(&mysql,"localhost","root","159753","packet",0,NULL,0)))//连接数据库 // printf("Could not connect to MySQL server!\n"); res = mysql_query(&mysql,"SELECT sourceip,count(*) FROM ip group by sourceip");//生成mysql语句 if(!(result = mysql_store_result(&mysql)))//返回查询结果 { printf("error!\n"); } else { numRecords=mysql_num_rows(result); fputs("<br>",fp); if(numRecords>10) fprintf(fp,"新IP出现频率：%d 通过与高峰访问期新IP的对比，主机可能受到DDOS攻击！\n",numRecords); else fprintf(fp,"新IP出现频率为：%d 通过与高峰访问期新IP的对比，在正常范围内！\n",numRecords); } mysql_free_result(result); // mysql_close(&mysql);//关闭数据库 fclose(fp); } void land(MYSQL mysql) { //MYSQL mysql; MYSQL_RES *result; MYSQL_ROW row; int res,n=0; int count,numRecords; //char * str="192:168:0:1"; FILE *fp