网络上的数据报侦听 - 武林网

网络上的数据报侦听-武林网#includemath.h#includestdio.h#includestring.h#includeWinsock2.h#includemstcpip.h#defineSTATUS_FAILED0xFFFF//定义异常出错代码#defineMAX_PACK_LEN65535//接收的最大IP报文#defineMAX_ADDR_LEN16//点分十进制地址的最大长度#defineMAX_PROTO_TEXT_LEN16//子协议名称(如"TCP")最大长度#defineMAX_PROTO_NUM12//子协议数量#defineMAX_HOSTNAME_LAN255//最大主机名长度#defineCMD_PARAM_HELPtruetypedefstruct_iphdr{unsignedcharh_lenver;//4位首部长度+4位IP版本号unsignedchartos;//8位服务类型TOSunsignedshorttotal_len;//16位总长度〔字节〕unsignedshortident;//16位标识unsignedshortfrag_and_flags;//3位标志位unsignedcharttl;//8位生存时间TTLunsignedcharproto;//8位协议(TCP,UDP或其他)unsignedshortchecksum;//16位IP首部校验和unsignedintsourceIP;//32位源IP地址unsignedintdestIP;//32位目的IP地址}IP_HEADER;typedefstruct_tcphdr//定义TCP首部{USHORTth_sport;//16位源端口USHORTth_dport;//16位目的端口unsignedintth_seq;//32位序列号unsignedintth_ack;//32位确认号unsignedcharth_lenres;//4位首部长度/6位保存字unsignedcharth_flag;//6位标志位USHORTth_win;//16位窗口大小USHORTth_sum;//16位校验和USHORTth_urp;//16位紧急数据偏移量}TCP_HEADER;typedefstruct_udphdr//定义UDP首部{unsignedshortuh_sport;//16位源端口unsignedshortuh_dport;//16位目的端口unsignedshortuh_len;//16位长度unsignedshortuh_sum;//16位校验和}UDP_HEADER;typedefstruct_icmphdr//定义ICMP首部{BYTEi_type;//8位类型BYTEi_code;//8位代码USHORTi_cksum;//16位校验和USHORTi_id;//辨别号〔一般用进程号作为辨别号〕USHORTi_seq;//报文序列号ULONGtimestamp;//时间戳}ICMP_HEADER;typedefstruct_protomap//定义子协议映射表{intProtoNum;charProtoText[MAX_PROTO_TEXT_LEN];}PROTOMAP;PROTOMAPProtoMap[MAX_PROTO_NUM]={//为子协议映射表赋值{IPPROTO_IP,"IP"},{IPPROTO_ICMP,"ICMP"},{IPPROTO_IGMP,"IGMP"},{IPPROTO_GGP,"GGP"},{IPPROTO_TCP,"TCP"},{IPPROTO_PUP,"PUP"},{IPPROTO_UDP,"UDP"},{IPPROTO_IDP,"IDP"},{IPPROTO_ND,"NP"},{IPPROTO_RAW,"RAW"},{IPPROTO_MAX,"MAX"},{NULL,""}};SOCKETSockRaw;charTcpFlag[6]={'F','S','R','P','A','U'};//定义TCP标志位boolParamTcp=false;//-t关注TCP报文boolParamUdp=false;//-u关注UDP报文boolParamIcmp=false;//-i关注ICMP报文boolParamDecode=false;//-d对协议进行解码char*strFromIpFilter=NULL;//源IP地址过滤char*strDestIpFilter=NULL;//目的地址过滤char*strSensitive=NULL;//敏感字符串intiPortFilter=0;//端口过滤intiProtocol,iTTL;charszProtocol[MAX_PROTO_TEXT_LEN];charszSourceIP[MAX_ADDR_LEN],szDestIP[MAX_ADDR_LEN];intDecodeIpPack(char*,int);//IP解包函数intDecodeTcpPack(char*,int);//TCP解包函数intDecodeUdpPack(char*,int);//UDP解包函数intDecodeIcmpPack(char*,int);//ICMP解包函数voidCheckSockError(int,char*);//出错处理函数char*CheckProtocol(int);//协议检查voidusage(void);//使用讲明boolGetCmdLine(int,char**);//命令行参数处理voidmain(intargc,char**argv){intiErrorCode;charRecvBuf[MAX_PACK_LEN]={0};usage();if(GetCmdLine(argc,argv)==CMD_PARAM_HELP)exit(0);//初始化SOCKETWSADATAwsaData;iErrorCode=WSAStartup(MAKEWORD(2,1),&wsaData);CheckSockError(iErrorCode,"WSAStartup");SockRaw=socket(AF_INET,SOCK_RAW,IPPROTO_IP);CheckSockError(SockRaw,"socket");//获取本机IP地址charFARname[MAX_HOSTNAME_LAN];iErrorCode=gethostname(name,MAX_HOSTNAME_LAN);CheckSockError(iErrorCode,"gethostname");structhostentFAR*pHostent;pHostent=(structhostent*)malloc(sizeof(structhostent));pHostent=gethostbyname(name);SOCKADDR_INsa;sa.sin_family=AF_INET;sa.sin_port=htons(6000);memcpy(&sa.sin_addr.S_un.S_addr,pHostent-h_addr_list[0],pHostent-h_length);free(pHostent);iErrorCode=bind(SockRaw,(PSOCKADDR)&sa,sizeof(sa));CheckSockError(iErrorCode,"bind");//设置SOCK_RAW为SIO_RCVALL，以便接收所有的IP包DWORDdwBufferLen[10];DWORDdwBufferInLen=1;DWORDdwBytesReturned=0;iErrorCode=WSAIoctl(SockRaw,SIO_RCVALL,&dwBufferInLen,sizeof(dwBufferInLen),&dwBufferLen,sizeof(dwBufferLen),&dwBytesReturned,NULL,NULL);CheckSockError(iErrorCode,"Ioctl");//侦听IP报文while(1){memset(RecvBuf,0,sizeof(RecvBuf));iErrorCode=recv(SockRaw,RecvBuf,sizeof(RecvBuf),0);CheckSockError(iErrorCode,"recv");iErrorCode=DecodeIpPack(RecvBuf,iErrorCode);CheckSockError(iErrorCode,"Decode");}}//IP解包程序intDecodeIpPack(char*buf,intiBufSize){IP_HEADER*pIpheader;SOCKADDR_INsaSource,saDest;pIpheader=(IP_HEADER*)buf;//协议甄别iProtocol=pIpheader-proto;strncpy(szProtocol,CheckProtocol(iProtocol),MAX_PROTO_TEXT_LEN);if((iProtocol==IPPROTO_TCP)&&(!ParamTcp))returntrue;if((iProtocol==IPPROTO_UDP)&&(!ParamUdp))returntrue;if((iProtocol==IPPROTO_ICMP)&&(!ParamIcmp))returntrue;//源地址saSource.sin_addr.s_addr=pIpheader-sourceIP;strncpy(szSourceIP,inet_ntoa(saSource.sin_addr),MAX_ADDR_LEN);if(strFromIpFilter)if(strcmp(strFromIpFilter,szSourceIP))returntrue;//目的地址saDest.sin_addr.s_addr=pIpheader-destIP;strncpy(szDestIP,inet_ntoa(saDest.sin_addr),MAX_ADDR_LEN);if(strDestIpFilter)if(strcmp(strDestIpFilter,szDestIP))returntrue;iTTL=pIpheader-//计算IP首部的长度intiIphLen=sizeof(unsignedlong)*(pIpheader-h_lenver//根据协议类型分别调用相应的函数switch(iProtocol){caseIPPROTO_TCP:DecodeTcpPack(buf+iIphLen,iBufSize);break;caseIPPROTO_UDP:DecodeUdpPack(buf+iIphLen,iBufSize);break;caseIPPROTO_ICMP:DecodeIcmpPack(buf+iIphLen,iBufSize);break;default:break;}//printf("");returntrue;}//协议辨别程序char*CheckProtocol(intiProtocol){for(inti=0;iMAX_PROTO_NUM;i++)if(ProtoMap.ProtoNum==iProtocol)returnProtoMap.ProtoText;return"";}//TCP解包程序intDecodeTcpPack(char*TcpBuf,intiBufSize){TCP_HEADER*pTcpHeader;inti;intiSourcePort,iDestPort;pTcpHeader=(TCP_HEADER*)TcpBuf;//计算TCP首部长度intTcpHeaderLen=pTcpHeader-th_lenres4;TcpHeaderLen*=sizeof(unsignedlong);char*TcpData=TcpBuf+TcpHeaderLen;//假如过滤敏感字符串则判定能否包含if(strSensitive)if((strstr(TcpData,strSensitive))==NULL)returntrue;//对端口进行过滤iSourcePort=ntohs(pTcpHeader-th_sport);iDestPort=ntohs(pTcpHeader-th_dport);if((iPortFilter)&&(iSourcePort!=iPortFilter)&&(iDestPort!=iPortFilter))returntrue;//输出printf("%s",szProtocol);printf("%15s:%5d-%15s:%5d",szSourceIP,iSourcePort,szDestIP,iDestPort);printf("TTL=%3d",iTTL);//判定TCP标志位unsignedcharFlagMask=1;for(i=0;ii++){if((pTcpHeader-th_flag)&FlagMask)printf("%c",TcpFlag);elseprintf("-");FlagMask=FlagMask1;}printf("bytes=%4d",iBufSize);printf("");//对于长度大于40字节的包进行数据分析(IP_HEADER+TCP_HEADER=40)if((ParamDecode)&&(iBufSize40)){//分析TCP数据段if((!strSensitive)||(strstr(TcpData,strSensitive))){printf("[DATA]");printf("%s",TcpData);printf("[DATAEND]");}}returntrue;}//UDP解包程序intDecodeUdpPack(char*UdpBuf,intiBufSize){UDP_HEADER*pUdpHeader;pUdpHeader=(UDP_HEADER*)UdpBuf;intiSourcePort=ntohs(pUdpHeader-uh_sport);intiDestPort=ntohs(pUdpHeader-uh_dport);//对端口进行过滤if(iPortFilter)if((iSourcePort!=iPortFilter)&&(iDestPort!=iPortFilter))returntrue;printf("%s",szProtocol);printf("%15s:%5d-%15s:%5d",szSourceIP,iSourcePort,szDestIP,iDestPort);printf("TTL=%3d",iTTL);printf("Len=%4d",ntohs(pUdpHeader-uh_len));printf("bytes=%4d",iBufSize);printf("");//对于长度大于28字节的包进行数据分析(IP_HEADER+UDP_HEADER28)if((ParamDecode)&&(iBufSize28)){printf("[DATA]");//UDP首部长度为8char*UdpData=UdpBuf+8;//分析UDP数据段for(unsignedinti=0;i(iBufSize-sizeof(UDP_HEADER));i++){if(!(i%8))printf("");if((UdpData33)&&(UdpData122))printf("%3c[%3x]",UdpData,UdpData);elseprintf("[%3x]",abs(UdpData));}printf("[DATAEND]");}returntrue;}//ICMP解包程序intDecodeIcmpPack(char*IcmpBuf,intiBufSize){ICMP_HEADER*pIcmpHeader;pIcmpHeader=(ICMP_HEADER*)IcmpBuf;intiIcmpType=pIcmpHeader-i_type;intiIcmpCode=pIcmpHeader-i_code;//对类型进行过滤if((iPortFilter)&&(iIcmpType!=iPortFilter))returntrue;printf("%s",szProtocol);//printf("%15sType%d-%15sCode%d",szSourceIP,iIcmpType,szDestIP,iIcmpCode);printf("%15s-%15s",szSourceIP,szDestIP);printf("TTL=%3d",iTTL);printf("Type%2d,%d",iIcmpType,iIcmpCode);printf("bytes=%4d",iBufSize);printf("");//对于包含数据段的包进行数据分析if((ParamDecode)&&(iBufSize28)){char*IcmpData=IcmpBuf+4;//分析ICMP数据段printf("[DATA]");for(unsignedinti=0;i(iBufSize-sizeof(ICMP_HEADER));i++){if(!(i%8))printf("");if((IcmpData33)&&(IcmpData122))printf("%3c[%3x]",IcmpData,IcmpData);elseprintf("[%3x]",abs(IcmpData));}printf("[DATAEND]");}returntrue;}//命令行参数处理boolGetCmdLine(intargc,char**argv){if(argc2)returnCMD_PARAM_HELP;for(inti=1;iargc;i++){if(argv[0]!='/')returnCMD_PARAM_HELP;elseswitch(argv[1]){case't':case'T':ParamTcp=true;break;case'u':case'U':ParamUdp=true;break;case'i':case'I':ParamIcmp=true;break;case'p':case'P':ParamDecode=true;break;case'f':case'F':{strFromIpFilter=(char*)malloc(16*sizeof(char));memset(strFromIpFilter,0,16*sizeof(char));strcpy(strFromIpFilter,argv+3);break;}case'd':case'D':{strDestIpFilter=(char*)malloc(16*sizeof(char));memset(strDestIpFilter,0,16*sizeof(char));strcpy(strDestIpFilter,argv+3);break;}case's':case'S':{strSensitive=(char*)malloc(255*sizeof(char));memset(strSensitive,0,255*sizeof(char));strcpy(strSensitive,argv+3);break;}case'o':case'O':{iPortFilter=atoi(argv+3);break;}}}printf("WillSniffer");if(ParamTcp)printf("TCP");if(ParamUdp)printf("UDP");if(ParamIcmp)printf("ICMP");if(strFromIpFilter)printf("FromIp:%s",strFro