关于c#实现影音嗅探的问题(转)

 这几天参考网上的RawSocket初步些了个，但发现丢包现象严重,效果很不理想很多时候都嗅探不出来
后来借助httpwatch的API接口页很理想，大家有什么关于.net上的实现思虑么？ vb.net或c#都行 


下面这个基类是我仿照网上些的
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.Net.Sockets;
using System.Net;

namespace v.sniffer
{
    /**
     * IP数据包结构，解释完毕的包存放到这里，最终用它来组成总的数据
     */
    [StructLayout(LayoutKind.Explicit)]
    public struct IPHeader
    {
        [FieldOffset(0)]
        public byte ip_verlen;        //I4位首部长度+4位IP版本号
        [FieldOffset(1)]
        public byte ip_tos;            //8位服务类型TOS
        [FieldOffset(2)]
        public ushort ip_totallength; //16位数据包总长度（字节）
        [FieldOffset(4)]
        public ushort ip_id;             //16位标识
        [FieldOffset(6)]
        public ushort ip_offset;       //3位标志位
        [FieldOffset(8)]
        public byte ip_ttl;            //8位生存时间 TTL
        [FieldOffset(9)]
        public byte ip_protocol;    //8位协议(TCP, UDP, ICMP, Etc.)
        [FieldOffset(10)]
        public ushort ip_checksum; //16位IP首部校验和
        [FieldOffset(12)]
        public uint ip_srcaddr;     //32位源IP地址
        [FieldOffset(16)]
        public uint ip_destaddr;   //32位目的IP地址
    }

    public class RawSocket
    {
        private bool error_occurred;          //套接字在接收包时是否产生错误
        public bool KeepRunning;              //是否继续进行
        private int len_receive_buf;       //得到的数据流的长度
        byte[] receive_buf_bytes;          //收到的字节
        private Socket socket = null;       //声明套接字
        const int SIO_RCVALL = unchecked((int)0x98000001);//监听所有的数据包

        /**
         * 构造函数
         */
        public RawSocket()
        {
            error_occurred = false;//没有产生错误
            len_receive_buf = 4096;//接收的数据流的长度
            receive_buf_bytes = new byte[len_receive_buf];//接收的内容
        }

        /**
         * 建立并绑定套接字
         *
         * @param 要监听的IP地址，单网卡的可以直接通过Dns.GetHostByName(Dns.GetHostEntry()).AddressList[0].ToString()方式来指定监听本地
         */
        public void CreateAndBindSocket(string IP)
        {
            socket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
            socket.Blocking = false;                                         //设置socket非阻塞状态
            socket.Bind(new IPEndPoint(IPAddress.Parse(IP), 0)); //绑定套接字

            if (SetSocketOption() == false) error_occurred = true;//开始侦听数据
        }

        /**
         * 侦听数据包的参数
         */
        private bool SetSocketOption()                           //设置raw socket
        {
            bool ret_value = true;
            try
            {
                socket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1);
                byte[] IN = new byte[4] { 1, 0, 0, 0 };
                byte[] OUT = new byte[4];

                //低级别操作模式,接受所有的数据包，这一步是关键，必须把socket设成raw和IP Level才可用SIO_RCVALL
                int ret_code = socket.IOControl(SIO_RCVALL, IN, OUT);
                ret_code = OUT[0] + OUT[1] + OUT[2] + OUT[3];//把4个8位字节合成一个32位整数
                if (ret_code != 0) ret_value = false;
            }
            catch (SocketException)
            {
                ret_value = false;
            }
            return ret_value;
        }

        public bool ErrorOccurred
        {
            get
            {
                return error_occurred;
            }
        }
        //解析接收的数据包，形成PacketArrivedEventArgs事件数据类对象，并引发PacketArrival事件
        unsafe private void Receive(byte[] buf, int len)
        {
            byte temp_protocol = 0;//协议
            uint temp_version = 0;//版本
            uint temp_ip_srcaddr = 0;//源地址
            uint temp_ip_destaddr = 0;//目的地址
            short temp_srcport = 0;//源端口
            short temp_dstport = 0;//目标端口
            IPAddress temp_ip;//IP地址

            PacketArrivedEventArgs e = new PacketArrivedEventArgs();//新网络数据包信息事件

            fixed (byte* fixed_buf = buf)
            {
                IPHeader* head = (IPHeader*)fixed_buf;//把数据流整和为IPHeader结构
                e.HeaderLength = (uint)(head->ip_verlen & 0x0F) << 2;
                e.IPHeaderBuffer = new byte[e.HeaderLength];

                temp_protocol = head->ip_protocol;
                switch (temp_protocol)//提取协议类型
                {
                    case 1: e.Protocol = "ICMP"; break;
                    case 2: e.Protocol = "IGMP"; break;
                    case 6: e.Protocol = "TCP"; break;
                    case 17: e.Protocol = "UDP"; break;
                    default: e.Protocol = "UNKNOWN"; break;
                }

                temp_version = (uint)(head->ip_verlen & 0xF0) >> 4;//提取IP协议版本
                e.IPVersion = temp_version.ToString();

                //以下语句提取出了PacketArrivedEventArgs对象中的其他参数
                temp_ip_srcaddr = head->ip_srcaddr;
                temp_ip_destaddr = head->ip_destaddr;
                temp_ip = new IPAddress(temp_ip_srcaddr);
                e.OriginationAddress = temp_ip.ToString();
                temp_ip = new IPAddress(temp_ip_destaddr);
                e.DestinationAddress = temp_ip.ToString();

                temp_srcport = *(short*)&fixed_buf[e.HeaderLength];
                temp_dstport = *(short*)&fixed_buf[e.HeaderLength + 2];
                e.OriginationPort = IPAddress.NetworkToHostOrder(temp_srcport).ToString();
                e.DestinationPort = IPAddress.NetworkToHostOrder(temp_dstport).ToString();

                e.PacketLength = (uint)len;
                e.MessageLength = (uint)len - e.HeaderLength;
                e.MessageBuffer = new byte[e.MessageLength];

                e.ReceiveBuffer = buf;
                //把buf中的IP头赋给PacketArrivedEventArgs中的IPHeaderBuffer
                Array.Copy(buf, 0, e.IPHeaderBuffer, 0, (int)e.HeaderLength);
                //把buf中的包中内容赋给PacketArrivedEventArgs中的MessageBuffer
                Array.Copy(buf, (int)e.HeaderLength, e.MessageBuffer, 0, (int)e.MessageLength);
            }
            //引发PacketArrival事件
            OnPacketArrival(e);
        }
        public void Run() //开始监听
        {
            if (socket != null)
            {
                IAsyncResult ar = socket.BeginReceive(receive_buf_bytes, 0, len_receive_buf, SocketFlags.None, new AsyncCallback(CallReceive), this);
            }
        }
        private void CallReceive(IAsyncResult ar)//异步回调
        {
            if (socket != null)
            {
                try
                {
                    int received_bytes;
                    received_bytes = socket.EndReceive(ar);
                    Receive(receive_buf_bytes, received_bytes);
                    if (KeepRunning) Run();
                }catch (Exception e) { }
            }
        }

        public void Shutdown()                                       //关闭raw socket
        {
            if (socket != null)
            {
                try
                {
                    socket.Shutdown(SocketShutdown.Both);
                    socket.Close();
                    socket = null;
                }catch (Exception e) { }
            }
        }

        public delegate void PacketArrivedEventHandler(Object sender, PacketArrivedEventArgs args);
        //事件句柄：包到达时引发事件
        public event PacketArrivedEventHandler PacketArrival;//声明时间句柄函数
        private void OnPacketArrival(PacketArrivedEventArgs e)
        {
            PacketArrivedEventHandler temp = PacketArrival;
            if (temp != null)
                temp(this, e);
        }

        public class PacketArrivedEventArgs : EventArgs
        {
            public uint HeaderLength;
            public string Protocol;
            public string IPVersion;
            public string OriginationAddress;
            public string DestinationAddress;
            public string OriginationPort;
            public string DestinationPort;
            public uint PacketLength;
            public uint MessageLength;
            public byte[] ReceiveBuffer;
            public byte[] IPHeaderBuffer;
            public byte[] MessageBuffer;
            public PacketArrivedEventArgs()
            {
            }
            public override string ToString()
            {
                StringBuilder sb = new StringBuilder();
                sb.Append("/r/n----------------/r/n");
                sb.AppendFormat("src = {0}:{1}, dst= {2}:{3}/r/n", OriginationAddress, OriginationPort,
                    DestinationAddress, DestinationPort);
                sb.AppendFormat("protocol = {0}, ipVersion={1}/r/n", Protocol, IPVersion);
                sb.AppendFormat("PacketLength={0},MessageLength={1}", PacketLength, MessageLength);
                sb.Append("/r/n----------------/r/n");
                return sb.ToString();
            }
        }

    }
}



这个是我的主窗口调用


using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using v.sniffer;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Collections;

namespace v.winForms
{
    public partial class listen : Form
    {
        private Hashtable ht = new Hashtable();
        private System.Data.DataTable httpTable =new DataTable("httpList");
        private RawSocket socket = null;
        delegate void mydelegate();//表单子线程代理   
        public listen()
        {
            InitializeComponent();
        }


        private void btn_browser_Click(object sender, EventArgs e)
        {
            if (!this.btn_ListenStart.Enabled)
            {
                this.startRequest();
            }
            else
            {
                MessageBox.Show("请先打开监听，在开始请求");
            }
        }

        private void startRequest()
        {
            if (!listenUrl.Text.Equals(""))
            {
                v.winForms.easyBrowser eBrowser = new easyBrowser();
                eBrowser.openUrl(listenUrl.Text);
                if (chkDebugMode.Checked)
                {
                    eBrowser.Show();
                }

            }
        }

        private void btn_ListenStart_Click(object sender, EventArgs e)
        {
            this.listenList.Invoke(new mydelegate(ListenThread));//初始化合同服务分类
            this.btn_ListenStart.Enabled = false;
            this.btn_ListenStop.Enabled = true;
        }

        private void btn_ListenStop_Click(object sender, EventArgs e)
        {
            this.listenList.Invoke(new mydelegate(ListenStop));//初始化合同服务分类
            this.btn_ListenStart.Enabled = true;
            this.btn_ListenStop.Enabled = false;
        }

        private void ListenStop()
        {
            if (this.socket != null)
            {
                this.socket.Shutdown();
            }
        }


        /**
        * 侦听线程
        */
        public void ListenThread()
        {
            try
            {
                socket = new RawSocket();
                IPAddress hosts = Dns.GetHostEntry(Dns.GetHostName()).AddressList[0];
                socket.CreateAndBindSocket(hosts.ToString());
                if (socket.ErrorOccurred)
                {
                    MessageBox.Show("侦听出错了");
                    return;
                }
                socket.KeepRunning = true;
                socket.PacketArrival += socket_PacketArrival;
                socket.Run();
                this.startRequest();
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.ToString());
                throw;
            }
            finally
            {
              
            }
        }

        private void appendRow(string strUrl,string strContentType)
        {
            string[] arrSubItem = new string[2];
            arrSubItem[0] = strUrl;
            arrSubItem[1] = strContentType;
            ListViewItem LiItem = new ListViewItem(arrSubItem, 0);
            LiItem.Tag = "这里可以存储额外的信息";
            this.listenList.Items.Add(LiItem);
        }


        private string byte2str(byte[] barr)
        {
            return Encoding.UTF8.GetString(barr).Trim();
            /*
             *System.Text.UnicodeEncoding converter = new System.Text.UnicodeEncoding();
                string strRequest = converter.GetString(httpData).Trim();
                //string strRequest = Encoding.ASCII.GetString(httpData).Trim();//UTF8
             */
        }
        void socket_PacketArrival(object sender, RawSocket.PacketArrivedEventArgs args)
        {

        [color=#FF0000]    string localIp = Dns.GetHostEntry(Dns.GetHostName()).AddressList[0].ToString();
            if (args.Protocol == "TCP" && args.OriginationAddress == localIp) // && (args.OriginationAddress == localIp || args.DestinationAddress == localIp)
            {
                byte[] httpData = new byte[args.MessageLength];
                Buffer.BlockCopy(args.MessageBuffer, 0, httpData, 0, httpData.Length);
                string strRequest = Encoding.UTF8.GetString(httpData).Trim();
              
                v.sniffer.headerSplit hSplit = new v.sniffer.headerSplit();
                hSplit.setHeader(strRequest);
                string strHost = hSplit.getHost();
                string strPath = hSplit.getPath();
                string strPort = args.DestinationPort;
                string strContentType = hSplit.getContentType();
                if (strPort.Equals("80"))
                {
                    strPort = "";
                }
                else
                {
                    strPort = ":" + strPort;
                }

                //if (!strHost.Equals(""))
                {
                    string strUrl = "http://" + strHost + strPort + strPath;
                    string strKey = args.OriginationPort + args.DestinationAddress + args.DestinationPort;

                    MessageBox.Show(strUrl);
                    if (ht.Contains(strKey))
                    {
                        ht[strKey] = strUrl;
                    }
                    else
                    {
                        ht.Add(strKey, strUrl);
                    }

                }

                if (!strContentType.Equals(""))
                {
                    string strKey = args.DestinationPort + args.OriginationAddress + args.OriginationPort;
                    string strUrl = "";
                    if (ht.Contains(strKey))
                    {
                        strUrl = ht[strKey].ToString();
                        ht.Remove(strKey);
                    }

                    bool isCheckType=(this.chk_listenType.Checked == false && strContentType.Contains("video/x-flv")||(this.chk_listenType.Checked == true));
                    if(!strUrl.Equals(""))
                    {
                        if (isCheckType)
                        {
                            this.appendRow(strUrl, strContentType);              
                        }
                        DataRow dataRow = httpTable.NewRow();
                        dataRow["url"] = strUrl;
                        dataRow["type"] = strContentType;
                        httpTable.Rows.Add(dataRow);
                    }[/color]
                }
              

            }
        }

        private void listen_Load(object sender, EventArgs e)
        {
            httpTable.Columns.Add("url", Type.GetType("System.String"));
            httpTable.Columns.Add("type", Type.GetType("System.String"));
            /*
            System.Windows.Forms.ColumnHeader urlColumn = new System.Windows.Forms.ColumnHeader();
            urlColumn.Text = "URL地址";
            urlColumn.Width = 500;
            this.listenList.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { urlColumn });
             */
        }

        private void btn_listClear_Click(object sender, EventArgs e)
        {
            this.listenList.Items.Clear();
            httpTable.Rows.Clear();
        }

        private void checkBox1_CheckedChanged(object sender, EventArgs e)
        {
            this.listenList.Items.Clear();
            for (int i = 0; i < httpTable.Rows.Count; i++)
            {
                bool isCheckType = (this.chk_listenType.Checked == false && httpTable.Rows[i]["type"].ToString().Contains("video/x-flv") || (this.chk_listenType.Checked == true));
                if (!httpTable.Rows[i]["url"].Equals(""))
                {
                    if (isCheckType)
                    {
                        string[] arrSubItem = new string[2];
                        arrSubItem[0] = httpTable.Rows[i]["url"].ToString();
                        arrSubItem[1] = httpTable.Rows[i]["type"].ToString();
                        ListViewItem LiItem = new ListViewItem(arrSubItem, 0);
                        LiItem.Tag = "这里可以存储额外的信息";
                        this.listenList.Items.Add(LiItem);
                    }
                }
            }
        }

        private void 打开ToolStripMenuItem_Click(object sender, EventArgs e)
        {

        }



    }
}


这个是分析http头用的

using System;
using System.Collections.Generic;
using System.Text;

namespace v.sniffer
{
    class headerSplit
    {
        private string[] Arrheader;
        public void setHeader(string strHeader)
        {
            this.Arrheader = strHeader.Split("/r/n/r/n".ToCharArray());
        }
        public string getPath()
        {
            string strPath = "";
            for (int i = 0; i < this.Arrheader.Length; i++)
            {
                bool matchPath = new System.Text.RegularExpressions.Regex("GET /.+ HTTP/").IsMatch(this.Arrheader[i].ToUpper()); // 在字符串中匹配
                if (matchPath)
                {
                    string[] tmp = this.Arrheader[i].Split(" ".ToCharArray());
                    for (int j = 0; j < tmp.Length; j++)
                    {
                        bool matchGet = new System.Text.RegularExpressions.Regex("GET").IsMatch(tmp[j].ToUpper());
                        int next = j + 1;
                        if (matchGet && next < tmp.Length)
                        {
                            strPath = tmp[next].Trim();
                            break;
                        }
                    }
                }
                if (!strPath.Equals(""))
                {
                    break;
                }
            }
            return strPath;
        }
        public string getHost()
        {
            string strHost = "";
            for (int i = 0; i < this.Arrheader.Length; i++)
            {
                bool matchHost = new System.Text.RegularExpressions.Regex("HOST: ").IsMatch(this.Arrheader[i].ToUpper()); // 在字符串中匹配
                if (matchHost)
                {
                    string[] tmp = this.Arrheader[i].Split(" ".ToCharArray());
                    for (int j = 0; j < tmp.Length; j++)
                    {
                        bool matchGet = new System.Text.RegularExpressions.Regex("HOST:").IsMatch(tmp[j].ToUpper());
                        int next = j + 1;
                        if (matchGet && next < tmp.Length)
                        {
                            strHost = tmp[next].Trim();
                            break;
                        }
                    }
                }
                if (!strHost.Equals(""))
                {
                    break;
                }
            }
            return strHost;
        }

        public string getContentType()
        {
            string strReturn = "";
            for (int i = 0; i < this.Arrheader.Length; i++)
            {
                bool boomatch = new System.Text.RegularExpressions.Regex("CONTENT-TYPE: ").IsMatch(this.Arrheader[i].ToUpper()); // 在字符串中匹配
                if (boomatch)
                {
                    string[] tmp = this.Arrheader[i].Split(" ".ToCharArray());
                    for (int j = 0; j < tmp.Length; j++)
                    {
                        bool matchGet = new System.Text.RegularExpressions.Regex("CONTENT-TYPE:").IsMatch(tmp[j].ToUpper());
                        int next = j + 1;
                        if (matchGet && next < tmp.Length)
                        {
                            strReturn = tmp[next].Trim();
                            break;
                        }
                    }
                }
                if (!strReturn.Equals(""))
                {
                    break;
                }
            }
            return strReturn;
        }
    }
}


这个是调用IE的插件

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;

namespace v.winForms
{
    public partial class easyBrowser : Form
    {
        public easyBrowser()
        {
            InitializeComponent();
        }

        private void easyBrowser_Load(object sender, EventArgs e)
        {
            //objBrowser.Navigate(txt_url.Text);
        }

        private void btn_go_Click(object sender, EventArgs e)
        {
            objBrowser.Navigate(txt_url.Text);
        }

        public void openUrl(string url)
        {
            txt_url.Text = url;
            objBrowser.Navigate(url);
        }
        private void objBrowser_DownloadComplete(object sender, EventArgs e)
        {

        }

        private void objBrowser_DocumentComplete(object sender, AxSHDocVw.DWebBrowserEvents2_DocumentCompleteEvent e)
        {

        }

    }
}