網(wǎng)絡(luò)上的數(shù)據(jù)報(bào)偵聽

2019-11-17 05:32:04

字體：大中小

供稿：網(wǎng)友

　　#include <math.h>
#include <stdio.h>
#include <string.h>
#include <Winsock2.h>
#include <mstcpip.h>

#define STATUS_FAILED 0xFFFF //定義異常出錯(cuò)代碼
#define MAX_PACK_LEN 65535 //接收的最大IP報(bào)文
#define MAX_ADDR_LEN 16 //點(diǎn)分十進(jìn)制地址的最大長度
#define MAX_PROTO_TEXT_LEN 16 //子協(xié)議名稱(如"TCP")最大長度
#define MAX_PROTO_NUM 12 //子協(xié)議數(shù)量
#define MAX_HOSTNAME_LAN 255 //最大主機(jī)名長度
#define CMD_PARAM_HELP true

typedef strUCt _iphdr
{
unsigned char h_lenver; //4位首部長度+4位IP版本號(hào)
unsigned char tos; //8位服務(wù)類型TOS
unsigned short total_len; //16位總長度（字節(jié)）
unsigned short ident; //16位標(biāo)識(shí)
unsigned short frag_and_flags; //3位標(biāo)志位
unsigned char ttl; //8位生存時(shí)間 TTL
unsigned char proto; //8位協(xié)議 (TCP, UDP 或其他)
unsigned short checksum; //16位IP首部校驗(yàn)和
unsigned int sourceIP; //32位源IP地址
unsigned int destIP; //32位目的IP地址
}IP_HEADER;

typedef struct _tcphdr //定義TCP首部
{
USHORT th_sport; //16位源端口
USHORT th_dport; //16位目的端口
unsigned int th_seq; //32位序列號(hào)
unsigned int th_ack; //32位確認(rèn)號(hào)
unsigned char th_lenres; //4位首部長度/6位保留字
unsigned char th_flag; //6位標(biāo)志位
USHORT th_win; //16位窗口大小
USHORT th_sum; //16位校驗(yàn)和
USHORT th_urp; //16位緊急數(shù)據(jù)偏移量
}TCP_HEADER;

typedef struct _udphdr //定義UDP首部
{
unsigned short uh_sport; //16位源端口
unsigned short uh_dport; //16位目的端口
unsigned short uh_len; //16位長度
unsigned short uh_sum; //16位校驗(yàn)和
} UDP_HEADER;

typedef struct _icmphdr //定義ICMP首部
{
BYTE i_type; //8位類型
BYTE i_code; //8位代碼
USHORT i_cksum; //16位校驗(yàn)和
USHORT i_id; //識(shí)別號(hào)（一般用進(jìn)程號(hào)作為識(shí)別號(hào)）
USHORT i_seq; //報(bào)文序列號(hào)
ULONG timestamp; //時(shí)間戳
}ICMP_HEADER;

typedef struct _protomap //定義子協(xié)議映射表
{
int ProtoNum;
char ProtoText[MAX_PROTO_TEXT_LEN];
}PROTOMAP;

PROTOMAP ProtoMap[MAX_PROTO_NUM]={ //為子協(xié)議映射表賦值
{ IPPROTO_IP , "IP " },
{ IPPROTO_ICMP , "ICMP" },
{ IPPROTO_IGMP , "IGMP" },
{ IPPROTO_GGP , "GGP " },
{ IPPROTO_TCP , "TCP " },
{ IPPROTO_PUP , "PUP " },
{ IPPROTO_UDP , "UDP " },
{ IPPROTO_IDP , "IDP " },
{ IPPROTO_ND , "NP " },
{ IPPROTO_RAW , "RAW " },
{ IPPROTO_MAX , "MAX " },
{ NULL , "" } };

SOCKET SockRaw;
char TcpFlag[6]={'F','S','R','P','A','U'}; //定義TCP標(biāo)志位
bool ParamTcp =false; // -t關(guān)注TCP 報(bào)文

bool ParamUdp =false; // -u關(guān)注UDP 報(bào)文
bool ParamIcmp =false; // -i關(guān)注ICMP報(bào)文
bool ParamDecode=false; // -d對(duì)協(xié)議進(jìn)行解碼
char *strFromIpFilter=NULL; // 源IP地址過濾
char *strDestIpFilter=NULL; // 目的地址過濾
char *strSensitive=NULL; // 敏感字符串
int iPortFilter=0; // 端口過濾
int iProtocol, iTTL;
char szProtocol[MAX_PROTO_TEXT_LEN];
char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];

int DecodeIpPack(char *, int); //IP解包函數(shù)
int DecodeTcpPack(char *, int); //TCP解包函數(shù)
int DecodeUdpPack(char *, int); //UDP解包函數(shù)
int DecodeIcmpPack(char *, int); //ICMP解包函數(shù)
void CheckSockError(int, char*); //出錯(cuò)處理函數(shù)
char * CheckProtocol(int); //協(xié)議檢查
void usage(void); //使用說明
bool GetCmdLine(int, char **); //命令行參數(shù)處理

void main(int argc, char ** argv)
{
int iErrorCode;
char RecvBuf[MAX_PACK_LEN] = {0};
usage();
if(GetCmdLine(argc, argv)==CMD_PARAM_HELP) exit(0);
//初始化SOCKET
WSADATA wsaData;
iErrorCode = WSAStartup(MAKEWord(2,1),&wsaData);
CheckSockError(iErrorCode, "WSAStartup");
SockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);
CheckSockError(SockRaw, "socket");
//獲取本機(jī)IP地址
char FAR name[MAX_HOSTNAME_LAN];
iErrorCode = gethostname(name, MAX_HOSTNAME_LAN);
CheckSockError(iErrorCode, "gethostname");
struct hostent FAR * pHostent;
pHostent = (struct hostent * )malloc(sizeof(struct hostent));
pHostent = gethostbyname(name);
SOCKADDR_IN sa;
sa.sin_family = AF_INET;
sa.sin_port = htons(6000);
memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);
free(pHostent);
iErrorCode = bind(SockRaw, (PSOCKADDR)&sa, sizeof(sa));
CheckSockError(iErrorCode, "bind");
//設(shè)置SOCK_RAW為SIO_RCVALL，以便接收所有的IP包
DWORD dwBufferLen[10] ;
DWORD dwBufferInLen = 1 ;
DWORD dwBytesReturned = 0 ;
iErrorCode=WSAIoctl(SockRaw, SIO_RCVALL,&dwBufferInLen, sizeof(dwBufferInLen),
&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );
CheckSockError(iErrorCode, "Ioctl");
//偵聽IP報(bào)文
while(1)
{
memset(RecvBuf, 0, sizeof(RecvBuf));
iErrorCode = recv(SockRaw, RecvBuf, sizeof(RecvBuf), 0);
CheckSockError(iErrorCode, "recv");
iErrorCode = DecodeIpPack(RecvBuf, iErrorCode);
CheckSockError(iErrorCode, "Decode");
}
}

//IP解包程序
int DecodeIpPack(char *buf, int iBufSize)
{
IP_HEADER *pIpheader;
SOCKADDR_IN saSource, saDest;

pIpheader = (IP_HEADER *)buf;
//協(xié)議甄別
iProtocol = pIpheader->proto;
strncpy(szProtocol, CheckProtocol(iProtocol), MAX_PROTO_TEXT_LEN);
if((iProtocol==IPPROTO_TCP) && (!ParamTcp)) return true;
if((iProtocol==IPPROTO_UDP) && (!ParamUdp)) return true;
if((iProtocol==IPPROTO_ICMP) && (!ParamIcmp)) return true;
//源地址
saSource.sin_addr.s_addr = pIpheader->sourceIP;
strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);
if (strFromIpFilter)
if (strcmp(strFromIpFilter,szSourceIP)) return true;
//目的地址
saDest.sin_addr.s_addr = pIpheader->destIP;
strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);
if (strDestIpFilter)
if (strcmp(strDestIpFilter,szDestIP)) return true;
iTTL = pIpheader->ttl;
//計(jì)算IP首部的長度
int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);
//根據(jù)協(xié)議類型分別調(diào)用相應(yīng)的函數(shù)
switch(iProtocol)
{
case IPPROTO_TCP :DecodeTcpPack(buf+iIphLen, iBufSize);break;
case IPPROTO_UDP :DecodeUdpPack(buf+iIphLen, iBufSize);break;
case IPPROTO_ICMP :DecodeIcmpPack(buf+iIphLen, iBufSize);break;
default :break;
}
//printf("/n");
return true;
}

//協(xié)議識(shí)別程序
char * CheckProtocol(int iProtocol)
{
for(int i=0; i<MAX_PROTO_NUM; i++)
if(ProtoMap[i].ProtoNum==iProtocol)
return ProtoMap[i].ProtoText;
return "";
}

//TCP解包程序
int DecodeTcpPack(char * TcpBuf, int iBufSize)
{
TCP_HEADER * pTcpHeader;
int i;
int iSourcePort,iDestPort;

pTcpHeader = (TCP_HEADER * )TcpBuf;
//計(jì)算TCP首部長度
int TcpHeaderLen = pTcpHeader->th_lenres>>4;
TcpHeaderLen *= sizeof(unsigned long);
char * TcpData=TcpBuf+TcpHeaderLen;
//假如過濾敏感字符串則判定是否包含
if (strSensitive)
if

上一篇：網(wǎng)際幕後的無名英雄----IP 原理實(shí)務(wù)探密

下一篇：網(wǎng)絡(luò)應(yīng)用三則