命令行下可以解讀TCP數(shù)據(jù)報(bào)內(nèi)容的Sniffer

2019-11-04 11:46:11

字體：大中小

來(lái)源：轉(zhuǎn)載

供稿：網(wǎng)友

開(kāi)放源代碼如下

#include "stdafx.h"
#include "stdio.h"
#include "string.h"
#include "mstcp#include "Winsock2.h"

#PRagma comment(lib,"WS2_32.lib")

#define STATUS_FAILED 0xFFFF //定義異常出錯(cuò)代碼
#define MAX_PACK_LEN 65535 //接收的最大

IP 報(bào)文
#define MAX_ADDR_LEN 16 //點(diǎn)分十進(jìn)制

地址的最大長(zhǎng)度
#define MAX_HOSTNAME_LAN 255 //最大主機(jī)名長(zhǎng)度

typedef strUCt _iphdr            //定義IP首部
{
unsigned char h_lenver;            //4 位首部長(zhǎng)度+4 位IP 版本號(hào)
unsigned char tos;             //8 位服務(wù)類型TOS
unsigned short total_len;           //16 位總長(zhǎng)度（字節(jié)）
unsigned short ident;            //16 位標(biāo)識(shí)
unsigned short frag_and_flags;          //3 位標(biāo)志位
unsigned char ttl;             //8 位生存時(shí)間TTL
unsigned char proto;            //8 位協(xié)議(TCP 或其他)
unsigned short checksum;           //16 位IP 首部校驗(yàn)和
unsigned int sourceIP;            //32 位源IP 地址
unsigned int destIP;            //32 位目的IP 地址
}IP_HEADER;

typedef struct _tcphdr            //定義TCP 首部
{
USHORT th_sport;            //16 位源端口
USHORT th_dport;            //16 位目的端口
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;           //4 位首部長(zhǎng)度/6 位保留字
unsigned char th_flag;            //6 位標(biāo)志位
USHORT th_win;              //16 位窗口大小
USHORT th_sum;            //16 位校驗(yàn)和
USHORT th_urp;         //16 位緊急數(shù)據(jù)偏移量
}TCP_HEADER;

SOCKET SockRaw;
char* TcpFlag[6]={             //定義TCP 標(biāo)志位
   "FIN ",              //FIN: 表示發(fā)送端已經(jīng)沒(méi)有數(shù)據(jù)要求傳輸了，希望釋放連接。
   "SYN ",              //SYN: 標(biāo)志位用來(lái)建立連接，讓連接雙方同步序列號(hào)。假如SYN＝1而ACK=0，則表示該數(shù)據(jù)包為連接請(qǐng)求，假如SYN=1而ACK=1則表示

接受連接。
"RST ", //RST: 用來(lái)復(fù)位一個(gè)連接。RST標(biāo)志置位的數(shù)據(jù)包稱為復(fù)位包。一般情況下，假如TCP收到的一個(gè)分段明顯不是屬于該主機(jī)上的任何一

個(gè)連接，則向遠(yuǎn)端發(fā)送一個(gè)復(fù)位包。
   "PSH ",              //PSH: 假如置位，接收端應(yīng)盡快把數(shù)據(jù)傳送給應(yīng)用層。
   "ACK ",             //ACK: 為確認(rèn)標(biāo)志位。假如為1，表示包中的確認(rèn)號(hào)時(shí)有效的。否則，包中的確認(rèn)號(hào)無(wú)效。
   "URG "              //URG: 為緊急數(shù)據(jù)標(biāo)志。假如它為1，表示本數(shù)據(jù)包中包含緊急數(shù)據(jù)。此時(shí)緊急數(shù)據(jù)指針有效。
   };
bool ParamTcp =true;            // -t 關(guān)注TCP 報(bào)文
char *strFromIpFilter=NULL;           // 源IP 地址過(guò)濾
char *strDestIpFilter=NULL;           // 目的地址過(guò)濾

//Referrence
int DecodeIpPack(char *,int);
int DecodeTcpPack(char *);
void CheckSockError(int,char*);
void usage(void);
bool GetCmdLine(int, char **);

//
void main(int argc, char ** argv)
{
int iErrorCode;
char RecvBuf[MAX_PACK_LEN] = { 0 };
usage();
if(GetCmdLine(argc, argv)==true)
exit(0);

//初始化SOCKET
WSADATA wsaData;
iErrorCode = WSAStartup(MAKEWord(2,1),&wsaData);
CheckSockError(iErrorCode, "WSAStartup");
SockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);
CheckSockError(SockRaw, "socket");

//獲取本機(jī)IP 地址
char FAR name[MAX_HOSTNAME_LAN];
iErrorCode = gethostname(name, MAX_HOSTNAME_LAN);
CheckSockError(iErrorCode, "gethostname");
struct hostent FAR * pHostent;
pHostent = (struct hostent * )malloc(sizeof(struct hostent));
pHostent = gethostbyname(name);
SOCKADDR_IN sa;
sa.sin_family = AF_INET;
sa.sin_port = htons(6000);
memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);
iErrorCode = bind(SockRaw, (PSOCKADDR)&sa, sizeof(sa));
CheckSockError(iErrorCode, "bind");

//設(shè)置SOCK_RAW 為SIO_RCVALL，以便接收所有的IP 包
DWORD dwBufferLen[10] ;
DWORD dwBufferInLen = 1 ;
DWORD dwBytesReturned = 0 ;
iErrorCode=WSAIoctl(SockRaw,
      SIO_RCVALL,
      &dwBufferInLen,
      sizeof(dwBufferInLen),
      &dwBufferLen,
      sizeof(dwBufferLen),
      &dwBytesReturned,
      NULL,
      NULL );
CheckSockError(iErrorCode, "Ioctl");

//偵聽(tīng)I(yíng)P 報(bào)文
while(true)
{
memset(RecvBuf, 0, sizeof(RecvBuf));
iErrorCode = recv(SockRaw, RecvBuf, sizeof(RecvBuf), 0);
CheckSockError(iErrorCode, "recv");
iErrorCode = DecodeIpPack(RecvBuf, iErrorCode);
CheckSockError(iErrorCode, "Decode");
}
}

//IP 解包程序
int DecodeIpPack(char *buf, int iBufSize)
{
IP_HEADER *pIpheader;
int iProtocol, iTTL;
char szProtocol[4];
char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];
SOCKADDR_IN saSource, saDest;
pIpheader = (IP_HEADER *)buf;

//Check Proto
iProtocol = pIpheader->proto;
strncpy(szProtocol, "TCP", 4);
if(iProtocol==IPPROTO_TCP)
{
//Check Source IP
saSource.sin_addr.s_addr = pIpheader->sourceIP;
strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);
if (strFromIpFilter)
if (strcmp(strFromIpFilter,szSourceIP))
return true;

//Check Dest IP
saDest.sin_addr.s_addr = pIpheader->destIP;
strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);
if (strDestIpFilter)
if (strcmp(strDestIpFilter,szDestIP))
return true;

//TTL
iTTL = pIpheader->ttl;

//Output
printf("%s ", szProtocol);
printf("%s->%s ", szSourceIP, szDestIP);
printf("bytes=%d TTL=%d ",iBufSize,iTTL);

//Calculate IP Header Length
int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);

//Decode Sub Protocol:TCP
DecodeTcpPack(buf+iIphLen);
}
return true;
}

//SOCK 錯(cuò)誤處理程序
void CheckSockError(int iErrorCode, char *pErrorMsg)
{
if(iErrorCode==SOCKET_ERROR)
{
printf("%s Error:%d/n", pErrorMsg, GetLastError());
closesocket(SockRaw);

exit(0);
}
}

//TCP 解包程序
int DecodeTcpPack(char * TcpBuf)
{
TCP_HEADER * pTcpHeader;
pTcpHeader = (TCP_HEADER * )TcpBuf;
printf("Port:%d->%d ", ntohs(pTcpHeader->th_sport),ntohs(pTcpHeader->th_dport));
unsigned char FlagMask = 1;
int HdrLen = (pTcpHeader->th_lenres)>>2;
printf("/n%s",((BYTE *)pTcpHeader)+HdrLen);
for( int i=0; i<6; i++ )
{
if((pTcpHeader->th_flag) & FlagMask)
printf("%s",TcpFlag[i]);
else
printf(" ");
FlagMask=FlagMask<<1;
}
printf("/n");
return true;
}

//命令行參數(shù)處理
bool GetCmdLine(int argc, char ** argv)
{
for(int i=1;i {
if(argv[i][0]!='/')
   return true;
else
{
   switch (argv[i][1])
   {
    case 'f':
    case 'F':
     {
      strFromIpFilter=(char*)malloc(16*sizeof(char));
      memset(strFromIpFilter,0,16*sizeof(char));
      strcpy(strFromIpFilter,argv[i]+3);
      break;
     }
    case 'd':
    case 'D':
     {
      strDestIpFilter=(char*)malloc(16*sizeof(char));
      memset(strDestIpFilter,0,16*sizeof(char));
      strcpy(strDestIpFilter,argv[i]+3);
      break;
     }
    case '?':
     return true;
     break;
    default:
     break;
   }
}
}
printf("/nWill Sniffer");
printf(" TCP");
if(strFromIpFilter)
printf(" FromIp:%s",strFromIpFilter);
if(strDestIpFilter)
printf(" DestIp:%s",strDestIpFilter);
printf("/n/tCTRL+C to quit/nStart:/n");
return (false);
}

void usage(void)
{
printf("/tSinffer for Win2K Console/n");
printf("USAGE:/n");
printf("/t/f: fromIP Output Packets FromIp=fromIP (default ALL)/n");
printf("/t/d: destIP Output Packets DestIp=destIP (default ALL)");
printf("/nExample:/n");
printf("/tsniffer.exe /d:192.168.15.233/n");
printf("/tsniffer.exe /f:192.168.15.231/n");
}