[关闭]
@xunuo 2017-07-21T17:03:27.000000Z 字数 15270 阅读 1409

DNS数据包分析

网络数据包分析

基础知识点链接

dns的实现是在端口号=53的基础上的；然后就可以设定过滤条件为"port 53"；只抓端口号为53的数据包；

  1. #include "pcap.h"
  2. #include<cstdlib>
  3. #include<vector>
  4. #include<string>
  5. using namespace std;
  6. /*ip地址*/
  7. typedef struct ip_address
  8. {
  9.     u_char byte1;
  10.     u_char byte2;
  11.     u_char byte3;
  12.     u_char byte4;
  13. } ip_address;
  14. /*以太网协议头*/
  15. struct ether_header
  16. {
  17.     u_int8_t ether_dhost[6]; //目的Mac地址
  18.     u_int8_t ether_shost[6]; //源Mac地址
  19.     u_int16_t ether_type;    //协议类型
  20. };
  21. /*IPv4协议头*/
  22. struct ip_header
  23. {
  24. #if defined(WORDS_BIENDIAN)
  25.     u_int8_t    ip_version : 4, ip_header_length : 4;
  26. #else
  27.     u_int8_t    ip_header_length : 4, ip_version : 4;
  28. #endif
  29.     u_int8_t    ip_tos;
  30.     u_int16_t   ip_length;
  31.     u_int16_t   ip_id;
  32.     u_int16_t   ip_off;
  33.     u_int8_t    ip_ttl;
  34.     u_int8_t    ip_protocol;
  35.     u_int16_t   ip_checksum;
  36.     ip_address  saddr;          /*源地址(Source address)*/
  37.     ip_address  daddr;          /*目的地址(Destination address)*/
  38. };
  40. /*UDP协议头*/
  41. struct udphdr
  42. {
  43.     u_int16_t source_port; /*源地址端口*/
  44.     u_int16_t dest_port;    /*目的地址端口*/
  45.     u_int16_t len;     /*UDP长度*/
  46.     u_int16_t check;   /*UDP校验和*/
  47. };
  49. //TCP协议头
  50. #define __LITTLE_ENDIAN_BITFIELD
  51. struct tcphdr
  52. {
  53.     u_int16_t   source_port;         /*源地址端口*/
  54.     u_int16_t   dest_port;           /*目的地址端口*/
  55.     u_int32_t   seq;            /*序列号*/
  56.     u_int32_t   ack_seq;        /*确认序列号*/
  57.     u_int8_t    tcp_header_length : 4;
  58. #if defined(__LITTLE_ENDIAN_BITFIELD)
  59.     u_int16_t res1 : 4,   /*保留*/
  60.         doff : 4,             /*偏移*/
  61.         fin : 1,              /*关闭连接标志*/
  62.         syn : 1,              /*请求连接标志*/
  63.         rst : 1,              /*重置连接标志*/
  64.         psh : 1,              /*接收方尽快将数据放到应用层标志*/
  65.         ack : 1,              /*确认序号标志*/
  66.         urg : 1,              /*紧急指针标志*/
  67.         ece : 1,              /*拥塞标志位*/
  68.         cwr : 1;              /*拥塞标志位*/
  69. #elif defined(__BIG_ENDIAN_BITFIELD)
  70.     u_int16_t doff : 4,   /*偏移*/
  71.         res1 : 4,             /*保留*/
  72.         cwr : 1,              /*拥塞标志位*/
  73.         ece : 1,              /*拥塞标志位*/
  74.         urg : 1,              /*紧急指针标志*/
  75.         ack : 1,              /*确认序号标志*/
  76.         psh : 1,              /*接收方尽快将数据放到应用层标志*/
  77.         rst : 1,              /*重置连接标志*/
  78.         syn : 1,              /*请求连接标志*/
  79.         fin : 1;              /*关闭连接标志*/
  80. #else
  81.     u_int16_t   flag;
  82. #endif
  83.     u_int16_t   window;         /*滑动窗口大小*/
  84.     u_int16_t   check;          /*校验和*/
  85.     u_int16_t   urg_ptr;        /*紧急字段指针*/
  86. };
  87. struct queries
  88. {
  89.     u_int16_t type;//类型;
  90.     u_int16_t clas;//采用的方法;
  91. };
  92. struct answers
  93. {
  94.     u_int16_t nameoff;//有偏移域名所占的两个字节
  95.     u_int16_t type;
  96.     u_int16_t clas;
  97.     u_int32_t time;//生存时间
  98.     u_int16_t len;
  99. };
  100. struct authority
  101. {
  102.     u_int16_t nameoff;
  103.     u_int16_t type;
  104.     u_int16_t clas;
  105.     u_int32_t time;
  106.     u_int16_t len;
  107. };
  108. /*DNS头*/
  109. struct dnshdr
  110. {
  111.     u_int16_t tra_id;//事务ID;
  112.     u_int16_t flag;//操作代码（0/1）;
  113.     u_int16_t qes;//问题计数；
  114.     u_int16_t ansrrs;//回答RR数;
  115.     u_int16_t au_rrs;//权威RR数;
  116.     u_int16_t add_rrs;//附加RRs;
  117. };
  118. /*flag是位置,cnt是标签*/
  119. int p=0;
  120. void domainname(int &flag, int &cnt, int &j,const u_char* packet_content,char ansname[])
  121. {
  122.     int num = packet_content[flag];
  123.     while (num > 0)
  124.     {
  125.         if (packet_content[flag] == 0xc0)//有偏移;
  126.         {
  127.             flag += 1;
  128.             int off = packet_content[flag];
  129.             domainname(off, cnt, j, packet_content, ansname);
  130.             if (p = 1)
  131.                 break;  
  132.         }
  133.         else
  134.         {
  135.             for (int i = 1; i <= num; i++)
  136.             {
  137.                 ansname[j] = packet_content[flag + i];
  138.                 j++;
  139.                 if (i == num&&packet_content[flag + num + 1] != 0)
  140.                 {
  141.                     ansname[j] = '.';
  142.                     j++;
  143.                 }
  144.             }
  145.             flag += num + 1;
  146.             cnt++;
  147.             num = packet_content[flag];
  148.         }
  149.     }
  150.     if (num == 0)
  151.         p = 1;  
  152. }
  153. void sixtoten(int &flag,int &num,const u_char* packet_content)
  154. {
  155.     int  m = 16777216;//（m=16^6）
  156.     for (int i = 0; i < 4; i++)
  157.     {
  158.         //printf("%02x %d\n", packet_content[flag + i], packet_content[flag + i]);
  159.         int number = packet_content[flag + i];
  160.         num += number*m;
  161.         m /= 256;
  162.     }
  163.     flag += 4;
  164. }
  165. void dns_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  166. {
  167.     struct dnshdr *dns_protocol;
  168.     dns_protocol = (struct dnshdr *) packet_content;
  169.     printf("---------DNS---------\n");
  170.     if (ntohs(dns_protocol->flag) == 0x0100)
  171.         printf("请求报文\n");
  172.     else
  173.         printf("应答报文\n");
  174.     printf("DNS ID:%04x\n", ntohs(dns_protocol->tra_id));
  175.     printf("操作代码：%04x\n", ntohs(dns_protocol->flag));
  176.     printf("问题计数：%d\n", ntohs(dns_protocol->qes));
  177.     printf("回答RR数：%d\n", ntohs(dns_protocol->ansrrs));
  178.     printf("权威RR数:%d\n", ntohs(dns_protocol->au_rrs));
  179.     printf("附加RR数：%d\n", ntohs(dns_protocol->add_rrs));
  180.     struct queries *dns_que;
  181.     const u_char* dns_packet_content;
  182.     char name[200];
  183.     memset(name, 0, sizeof(name));
  184.     int quenum = ntohs(dns_protocol->qes);
  185.     int flag = 12;
  186.     /*---------Queries:------*/
  187.     while (quenum--)
  188.     {
  189.         int cnt = 0, j = 0;
  190.         printf("---------Queries:------\n");
  191.         domainname(flag, cnt, j, packet_content,name);
  192.         printf("域名(Name):%s\n", name);
  193.         printf("域名长度(Name Length)：%d\n", j);
  194.         printf("标签长度(Label Count)：%d\n", cnt);
  195.         dns_packet_content = packet_content + 12 + 2 + j;
  196.         dns_que = (struct queries *) dns_packet_content;
  197.         printf("type:%04x\n", ntohs(dns_que->type));
  198.         printf("Class:%04x\n", ntohs(dns_que->clas));
  199.         flag += 4 + 1;
  200.     }
  202.     /*---------Answers:------*/
  203.     int ansnum = ntohs(dns_protocol->ansrrs);
  204.     if (ansnum > 0)
  205.     {
  206.         printf("---------Answers:------\n");
  208.         int off1;
  209.         while (ansnum--)
  210.         {
  212.             struct answers *dns_ans;
  213.             const u_char* dns_ans_packet_content;
  214.             dns_ans_packet_content = packet_content + flag;
  215.             dns_ans = (struct answers *) dns_ans_packet_content;
  216.             char ansname[200];
  217.             memset(ansname, 0, sizeof(ansname));
  218.             int cnt = 0;
  219.             int j = 0;
  220.             flag += 1;
  221.             off1 = packet_content[flag];
  222.             /*printf("off1:%02x\n", off1);*/
  223.             domainname(off1, cnt, j, packet_content,ansname);
  224.             /*printf("flag:%d\n", flag);*/
  225.             printf("域名(Ansname):%s\n", ansname);
  226.             printf("类型(Type):%04x\n", ntohs(dns_ans->type));
  227.             printf("类(Class):%04x\n", ntohs(dns_ans->clas));
  228.             printf("生存时间(Time to live):%08x\n", ntohs(dns_ans->time));
  229.             flag += 10;
  230.             printf("数据长度(Data length):%d\n",packet_content[flag]);
  231.             if (packet_content[ flag] == 4)//Address
  232.             {
  233.                 struct ip_address *dns_add;
  234.                 const u_char* dns_add_packet_content;
  235.                 flag += 1;
  236.                 dns_add_packet_content = packet_content + flag;
  237.                 dns_add = (struct ip_address *) dns_add_packet_content;
  238.                 printf("地址(Adress):%d.%d.%d.%d\n", dns_add->byte1, dns_add->byte2, dns_add->byte3, dns_add->byte4);
  239.                 flag += 4;
  240.                 printf("--------------------\n");
  241.             }
  242.             else//域名
  243.             {
  244.                 char cname[200];
  245.                 memset(cname, 0, sizeof(cname));
  246.                 flag+=1;
  247.                 printf("flag and packet:%d %02x\n", flag, packet_content[flag]);
  248.                 int j = cnt = 0;
  249.                 domainname(flag, cnt, j, packet_content,cname);
  250.                 printf("域名(Cname):%s\n", cname);
  251.                 flag += 1;
  252.                 /*printf("flag::::%d\n", flag);*/
  253.                 printf("--------------------\n");
  254.             }
  255.         }
  256.     }
  258.     /*---------Authoritative nameservers:------*/
  259.     int authonum = ntohs(dns_protocol->au_rrs);
  260.     if (authonum > 0)
  261.     {
  262.         printf("---------Authoritative nameservers:------\n");
  263.         int off1;
  264.         while (authonum--)
  265.         {
  266.             struct authority *dns_aut;
  267.             const u_char* dns_aut_packet_content;
  268.             dns_aut_packet_content = packet_content + flag;
  269.             dns_aut = (struct authority *) dns_aut_packet_content;
  270.             char autname[200];
  271.             memset(autname, 0, sizeof(autname));
  272.             int cnt = 0;
  273.             int j = 0;
  274.             flag += 1;
  275.             off1 = packet_content[flag];
  276.             /*printf("off1:%02x\n", off1);*/
  277.             if (off1 == 0)
  278.             {
  279.                 autname[0] = '<';
  280.                 autname[1] = 'R';
  281.                 autname[2] = 'o';
  282.                 autname[3] = 'o';
  283.                 autname[4] = 't';
  284.                 autname[5] = '>';
  285.                 flag += 1;
  286.             }
  287.             else
  288.                 domainname(off1, cnt, j, packet_content, autname);
  289.             /*printf("flag:%d\n", flag);*/
  290.             printf("域名(Ansname):%s\n", autname);
  291.             printf("类型(Type):%04x\n", ntohs(dns_aut->type));
  292.             printf("类(Class):%04x\n", ntohs(dns_aut->clas));
  293.             printf("生存时间(Time to live):%08x\n", ntohs(dns_aut->time));
  294.             flag += 10;
  295.             /*printf("flag:%d\n", flag);*/
  296.             printf("数据长度(Data length):%d\n", packet_content[flag]);
  297.             if (packet_content[flag] == 4)//Address
  298.             {
  299.                 struct ip_address *dns_add;
  300.                 const u_char* dns_add_packet_content;
  301.                 flag += 1;
  302.                 dns_add_packet_content = packet_content + flag;
  303.                 dns_add = (struct ip_address *) dns_add_packet_content;
  304.                 printf("地址(Adress):%d.%d.%d.%d\n", dns_add->byte1, dns_add->byte2, dns_add->byte3, dns_add->byte4);
  305.                 flag += 4;
  306.                 //printf("--------------------\n");
  307.             }
  308.             else//域名
  309.             {
  310.                 char cname[200];
  311.                 memset(cname, 0, sizeof(cname));
  312.                 flag += 1;
  313.                 /*printf("flag and packet:%d %02x\n", flag, packet_content[flag]);*/
  314.                 int j = cnt = 0;
  315.                 domainname(flag, cnt, j, packet_content, cname);
  316.                 printf("Primary name server:%s\n", cname);
  317.                 flag += 1;
  318.                 /*printf("flag:%d\n", flag);*/
  319.                 //printf("--------------------\n");
  320.             }
  321.             char mail[200];
  322.             memset(mail, 0, sizeof(mail));
  323.             printf("flag and packet:%d %02x\n", flag, packet_content[flag]);
  324.              j = cnt = 0;
  325.             domainname(flag, cnt, j, packet_content, mail);
  326.             printf("Responsible authority's mailbox:%s\n", mail);
  327.             flag += 1;
  329.             printf("flag:%d\n", flag);
  331.             int serialnum = 0;
  332.             sixtoten(flag, serialnum, packet_content);
  333.             printf("Seral Number:%d\n", serialnum);
  335.             int refreshint = 0;
  336.             sixtoten(flag, refreshint, packet_content);
  337.             printf("Refresh Interval:%d\n", refreshint);
  339.             int retyinterval = 0;
  340.             sixtoten(flag, retyinterval, packet_content);
  341.             printf("Retry Interval:%d\n", retyinterval);
  343.             int expirelimit = 0;
  344.             sixtoten(flag, expirelimit, packet_content);
  345.             printf("Expire limit:%d\n", expirelimit);
  347.             int mimimunttl = 0;
  348.             sixtoten(flag, mimimunttl, packet_content);
  349.             printf("Mininum TTL:%d\n", mimimunttl);
  350.         }
  351.     }
  353.     /*---------Additional records------*/
  354.     int addnum = ntohs(dns_protocol->add_rrs);
  355.     if (addnum > 0)
  356.     {
  357.         printf("---------Additional records:------\n");
  358.         int off1;
  359.         while (addnum--)
  360.         {
  361.             struct authority *dns_add;
  362.             const u_char* dns_add_packet_content;
  363.             /*printf("flag:%d\n", flag);*/
  364.             dns_add_packet_content = packet_content + flag;
  365.             dns_add = (struct authority *) dns_add_packet_content;
  366.             char autname[200];
  367.             memset(autname, 0, sizeof(autname));
  368.             int cnt = 0;
  369.             int j = 0;
  370.             flag += 1;
  371.             off1 = packet_content[flag];
  372.             /*printf("off1:%02x\n", off1);*/
  373.             domainname(off1, cnt, j, packet_content, autname);
  374.             /*printf("flag:%d\n", flag);*/
  375.             printf("域名(Ansname):%s\n", autname);
  376.             printf("类型(Type):%04x\n", ntohs(dns_add->type));
  377.             printf("类(Class):%04x\n", ntohs(dns_add->clas));
  378.             printf("生存时间(Time to live):%08x\n", ntohs(dns_add->time));
  379.             flag += 10;
  380.             printf("数据长度(Data length):%d\n", packet_content[flag]);
  381.             if (packet_content[flag] == 4)//Address
  382.             {
  383.                 struct ip_address *dns_add;
  384.                 const u_char* dns_add_packet_content;
  385.                 flag += 1;
  386.                 dns_add_packet_content = packet_content + flag;
  387.                 dns_add = (struct ip_address *) dns_add_packet_content;
  388.                 printf("地址(Adress):%d.%d.%d.%d\n", dns_add->byte1, dns_add->byte2, dns_add->byte3, dns_add->byte4);
  389.                 flag += 4;
  390.                 printf("--------------------\n");
  391.             }
  392.             else//域名
  393.             {
  394.                 char cname[200];
  395.                 memset(cname, 0, sizeof(cname));
  396.                 flag += 1;
  397.                 /*printf("flag and packet:%d %02x\n", flag, packet_content[flag]);*/
  398.                 int j = cnt = 0;
  399.                 domainname(flag, cnt, j, packet_content, cname);
  400.                 printf("域名(Cname):%s\n", cname);
  401.                 flag += 1;
  402.                 /*printf("flag::::%d\n", flag);*/
  403.                 printf("--------------------\n");
  404.             }
  405.         }
  406.     }
  407. }
  409. //UDP协议分析
  410. void udp_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  411. {
  412.     struct udphdr *udp_protocol;
  413.     u_int header_length = 0;
  414.     u_int16_t checksum;
  416.     udp_protocol = (struct udphdr *) packet_content;
  417.     checksum = ntohs(udp_protocol->check);
  419.     u_int16_t source_port; /*源地址端口*/
  420.     u_int16_t dest_port;    /*目的地址端口*/
  421.     u_int16_t len;     /*UDP长度*/
  422.     u_int16_t check;   /*UDP校验和*/
  424.     printf("---------UDP协议---------\n");
  425.     printf("源端口:%d\n", ntohs(udp_protocol->source_port));
  426.     printf("目的端口:%d\n", ntohs(udp_protocol->dest_port));
  427.     printf("UDP数据包长度:%d\n", ntohs(udp_protocol->len));
  428.     printf("UDP校验和:%d\n", checksum);
  429.     if (ntohs(udp_protocol->source_port) == 53 || ntohs(udp_protocol->dest_port) == 53)
  430.     {
  431.         //printf("dns data:\n%s\n", packet_content + sizeof(udphdr));
  432.         dns_protool_packet_callback(argument, packet_header, packet_content + sizeof(udphdr));
  433.     }
  434. }
  436. //TCP协议分析
  437. void tcp_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  438. {
  439.     struct tcphdr *tcp_protocol;
  440.     u_int header_length = 0;
  441.     u_int offset;
  442.     u_char tos;
  443.     u_int16_t checksum;
  445.     tcp_protocol = (struct tcphdr *) packet_content;
  446.     checksum = ntohs(tcp_protocol->check);
  448.     printf("---------TCP协议---------\n");
  449.     printf("源端口:%d\n", ntohs(tcp_protocol->source_port));
  450.     printf("目的端口:%d\n", ntohs(tcp_protocol->dest_port));
  451.     printf("SEQ:%d\n", ntohl(tcp_protocol->seq));
  452.     printf("ACK SEQ:%d\n", ntohl(tcp_protocol->ack_seq));
  453.     printf("TCP校验和:%d\n", checksum);
  455.     if (ntohs(tcp_protocol->source_port) == 80 || ntohs(tcp_protocol->dest_port) == 80)//http协议
  456.         printf("http data:\n%s\n", packet_content + sizeof(tcphdr));
  457. }
  459. //IP协议分析
  460. void ip_protool_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  461. {
  462.     struct ip_header *ip_protocol;
  463.     u_int offset;
  464.     u_char tos;
  465.     u_int16_t checksum;
  467.     ip_protocol = (struct ip_header *)packet_content;
  468.     checksum = ntohs(ip_protocol->ip_checksum);
  469.     tos = ip_protocol->ip_tos;
  470.     offset = ntohs(ip_protocol->ip_off);
  471.     printf("---------IP协议---------\n");
  472.     printf("版本号:%d\n", ip_protocol->ip_version);
  473.     printf("首部长度:%d %d\n", ip_protocol->ip_header_length, sizeof(ip_header));
  474.     printf("服务质量:%d\n", tos);
  475.     printf("总长度:%d\n", ntohs(ip_protocol->ip_length));
  476.     printf("标识:%d\n", ntohs(ip_protocol->ip_id));
  477.     printf("偏移:%d\n", (offset & 0x1fff) * 8);
  478.     printf("生存时间:%d\n", ip_protocol->ip_ttl);
  479.     printf("协议类型:%d\n", ip_protocol->ip_protocol);
  480.     printf("检验和:%d\n", checksum);
  481.     printf("源IP地址:%d.%d.%d.%d\n", ip_protocol->saddr.byte1, ip_protocol->saddr.byte2, ip_protocol->saddr.byte3, ip_protocol->saddr.byte4);
  482.     printf("目的地址:%d.%d.%d.%d\n", ip_protocol->daddr.byte1, ip_protocol->daddr.byte2, ip_protocol->daddr.byte3, ip_protocol->daddr.byte4);
  484.     switch (ip_protocol->ip_protocol)
  485.     {
  486.     case 1: printf("上层协议是ICMP协议\n"); break;
  487.     case 2: printf("上层协议是IGMP协议\n"); break;
  488.     case 6:
  489.     {
  490.         printf("上层协议是TCP协议\n");
  491.         tcp_protool_packet_callback(argument, packet_header, packet_content + sizeof(ip_header));
  492.     }
  493.     break;
  494.     case 17:
  495.     {
  496.         printf("上层协议是UDP协议\n");
  497.         udp_protool_packet_callback(argument, packet_header, packet_content + sizeof(ip_header));
  498.     }
  499.     break;
  500.     default:break;
  501.     }
  502. }
  504. //以太网协议分析
  505. void ethernet_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr* packet_header, const u_char* packet_content)
  506. {
  507.     u_short ethernet_type;
  508.     struct ether_header *ethernet_protocol;
  509.     u_char *mac_string;
  510.     static int packet_number = 1;
  511.     printf("----------------------------------------------\n");
  512.     printf("捕获第%d个网络数据包\n", packet_number);
  513.     printf("该数据包的具体内容：\n");
  514.     for (int i = 1; i <= packet_header->len; i++)
  515.     {
  516.         printf("%02x(%d) ", packet_content[i - 1],i-1-42);
  517.         if (i % 8 == 0)
  518.             printf(" ");
  519.         if (i % 16 == 0)
  520.             printf("\n");
  521.     }
  522.     printf("\n");
  523.     printf("数据包长度:%d\n", packet_header->len);
  524.     printf("---------以太网协议---------\n");
  525.     ethernet_protocol = (struct ether_header*)packet_content;//获得数据包内容
  526.     ethernet_type = ntohs(ethernet_protocol->ether_type);//获得以太网类型
  527.     printf("以太网类型:%04x\n", ethernet_type);
  528.     mac_string = ethernet_protocol->ether_shost;
  529.     printf("MAC帧源地址:%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5));
  530.     mac_string = ethernet_protocol->ether_dhost;
  531.     printf("MAC帧目的地址:%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5));
  532.     switch (ethernet_type)
  533.     {
  534.     case 0x0800:
  535.     {
  536.         printf("上层协议是IPv4协议\n");
  537.         ip_protool_packet_callback(argument, packet_header, packet_content + sizeof(ether_header));
  539.     }
  540.     break;
  541.     case 0x0806:
  542.         printf("上层协议是ARP协议\n");
  543.         break;
  544.     case 0x8035:
  545.         printf("上层协议是RARP协议\n");
  546.         break;
  547.     case 0x814C:
  548.         printf("上层协议是简单网络管理协议SNMP\n");
  549.         break;
  550.     case 0x8137:
  551.         printf("上层协议是因特网包交换（IPX：Internet Packet Exchange）\n");
  552.         break;
  553.     case 0x86DD:
  554.         printf("上层协议是IPv6协议\n");
  555.         break;
  556.     case 0x880B:
  557.         printf("上层协议是点对点协议（PPP：Point-to-Point Protocol）\n");
  558.         break;
  559.     default:break;
  560.     }
  561.     printf("----------------------------------------------\n");
  562.     packet_number++;
  563. }
  565. int main()
  566. {
  567.     pcap_if_t * allAdapters;               //适配器列表
  568.     pcap_if_t * adapter;                  //跑适配器列表
  569.     pcap_t    * adapterHandle;            //适配器句柄
  570.                                           //char error_content[PCAP_ERRBUF_SIZE]; //存储错误信息
  571.     bpf_u_int32 net_mask = 0;             //掩码地址
  572.     bpf_u_int32 net_ip = 0;               //网络地址
  573.     char *net_interface;                  //网络接口
  574.     struct bpf_program bpf_filter;        //BPF过滤规则
  575.     char bpf_filter_string[] = "port 53";      //过滤规则字符串，只分析IPv4的数据包
  576.     char errorBuffer[PCAP_ERRBUF_SIZE];   //错误信息缓冲区
  577.     if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &allAdapters, errorBuffer) == -1) //检索机器连接的所有网络适配器
  578.     {
  579.         fprintf(stderr, "Error in pcap_findalldevs_ex function: %s\n", errorBuffer);
  580.         return -1;
  581.     }
  582.     if (allAdapters == NULL) //不存在任何适配器
  583.     {
  584.         printf("\nNo adapters found! Make sure WinPcap is installed.\n");
  585.         return 0;
  586.     }
  587.     int crtAdapter = 0;
  588.     for (adapter = allAdapters; adapter != NULL; adapter = adapter->next)
  589.     {   //遍历输入适配器信息(名称和描述信息)
  590.         printf("\n%d.%s ", ++crtAdapter, adapter->name);
  591.         printf("-- %s\n", adapter->description);
  592.     }
  593.     printf("\n");
  594.     int adapterNumber;
  595.     printf("Enter the adapter number between 1 and %d:", crtAdapter);//选择要捕获数据包的适配器
  596.     scanf_s("%d", &adapterNumber);
  597.     if (adapterNumber < 1 || adapterNumber > crtAdapter)
  598.     {
  599.         printf("\nAdapter number out of range.\n");
  600.         pcap_freealldevs(allAdapters);// 释放适配器列表
  601.         return -1;
  602.     }
  603.     adapter = allAdapters;
  604.     for (crtAdapter = 0; crtAdapter < adapterNumber - 1; crtAdapter++)
  605.         adapter = adapter->next;
  606.     adapterHandle = pcap_open(adapter->name, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errorBuffer);// 打开指定适配器
  607.     if (adapterHandle == NULL)//指定适配器打开失败
  608.     {
  609.         fprintf(stderr, "\nUnable to open the adapter\n", adapter->name);
  610.         pcap_freealldevs(allAdapters);// 释放适配器列表
  611.         return -1;
  612.     }
  613.     char errbuf[2048];
  614.     pcap_createsrcstr(NULL, 0, NULL, "80", NULL, errbuf);
  616.     printf("\nCapture session started on  adapter %s\n", adapter->name);
  617.     pcap_freealldevs(allAdapters);//释放适配器列表
  619.     pcap_compile(adapterHandle, &bpf_filter, bpf_filter_string, 0, net_ip); //编译过滤规则
  620.     pcap_setfilter(adapterHandle, &bpf_filter);//设置过滤规则
  621.     if (pcap_datalink(adapterHandle) != DLT_EN10MB) //DLT_EN10MB表示以太网
  622.         return 0;
  623.     pcap_loop(adapterHandle, 100, ethernet_protocol_packet_callback, NULL); //捕获65536个数据包进行分析
  624.     pcap_close(adapterHandle);
  625.     return 0;
  626. }
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注