winpcap安装使用教程

1、安装winpcap

地址：http://www.winpcap.org/install/default.htm =》安装软件

地址：http://www.winpcap.org/archive =》下载package开发包wpdPack

a) 执行安装包，这样你的机子就能运行winpcap程序了

b)解压开发包，在VC6.0的Tools-->Option-->Directories的Include fils 和library files加入winpcap的include和lib目录

c)在项目属性页中：配置属性->C/C++->预处理器->预处理器定义，增加;WPCAP;HAVE_REMOTE;

d)在项目属性页中：配置属性->链接器->命令行->附加选项对应的文本框中增加：“wpcap.lib ws2_32.lib Packet.lib”

如果出现missing';'这种的，需要转到错误处，注视掉它们即可；

2、winpcap使用教程

a)一个简单的例子，获取网络设配器基本信息：

#include <pcap.h>// 必须引入的包
#pragma   comment(   lib,   "wpcap.lib"   )// 库文件
int main()
{
    pcap_if_t *alldevs;//定义要获取的设备组
    pcap_if_t *d;//定义单个设备组
    int i = 0;//下面的for循环用
    char errbuf[PCAP_ERRBUF_SIZE];//定义错误信息
	
    /* 获取本地所有网络设配器的列表 */
    if(pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
    {
		// 获取失败，打印错误信息
        fprintf(stderr, "Error in pcap_findalldevs_ex: %s\n", errbuf);
        exit(1);
    }
	
    /* 循环打印设配器列表 */
    for(d = alldevs; d != NULL; d = d->next)
    {
		// 打印设配器的名字
        printf("%d. %s", ++i, d->name);
		// 打印设配器的描述信息
        if (d->description)
            printf("(%s)\n", d->description);
        else
            printf("(No description available)\n");
    }
	// 没有任何设配器列表
    if(i == 0)
    {
        printf("\nNo interfaces found! Make sure Winpcap is installed.\n");
        return -1;
    }
	// 释放设配器列表指针的内存
    pcap_freealldevs(alldevs);
	// 防止命令窗口一闪而过
	char c = getchar();
    return 0;
}

b) 获取详细的网络设配器的信息：

#include "pcap.h"
// #include <WINSOCK2.H>
// #pragma comment(lib,"ws2_32.lib")
#pragma comment(lib,"wpcap.lib")
#define IPTOSBUFFERS 12
void ifprint(pcap_if_t *d);
char * iptos(u_long in);
int i = 0;
int main()
{
	pcap_if_t * alldevs;
	pcap_if_t * d;
	
	char errbuf[PCAP_ERRBUF_SIZE];
	/*取得列表*/
	if(pcap_findalldevs(&alldevs,errbuf) == -1)
	{
		exit(1);
	}
	/*输出列表*/
	for(d=alldevs;d != NULL;d=d->next)
	{
		ifprint(d);
	}
	if(i==0)
	{

		printf("\nNo interfaces found!Make sure WinPcap is installed.\n");
		return 0;
	}
	pcap_freealldevs(alldevs);
	char g=getchar();
	return 0;
}
void ifprint(pcap_if_t *d)
{
	pcap_addr_t *a;
	printf("%d.%s",++i,d->name);
	if(d->description)
	{
		printf("\tDescription:(%s)\n",d->description);
	}else{
		printf("\t(No description available)\n");
	}
	printf("\tLoopback:%s\n",(d->flags & PCAP_IF_LOOPBACK)?"yes":"no");
	for (a=d->addresses;a != NULL;a=a->next)
	{
		printf("\tAddress Family:#%d\n",a->addr->sa_family);
		switch (a->addr->sa_family)
		{
		case AF_INET:
			printf("\tAddress Family Name:AF_INET\n");
			if(a->addr)
			{
				printf("\tAddress:%s\n",iptos(((struct sockaddr_in *)a->addr)->sin_addr.s_addr));
			}
			if(a->netmask)
			{
				printf("\tNetmask:%s\n",iptos(((struct sockaddr_in *)a->netmask)->sin_addr.s_addr));
			}
			if(a->broadaddr)
			{
				printf("\tBroadcast Address:%s\n",iptos(((struct sockaddr_in *)a->broadaddr)->sin_addr.s_addr));
			}
			if(a->dstaddr)
			{
				printf("\tDestination Address:%s\n",iptos(((struct sockaddr_in *)a->dstaddr)->sin_addr.s_addr));
			}
			break;
		default:
			printf("\tAddressFamilyName:Unknown\n");
			break;
		}
	}
}
char * iptos(u_long in)
{ 
	static char output[IPTOSBUFFERS][3*4+3+1];
	static short which;
	u_char *p; 
	p = (u_char *)&in;
	which=(which+1==IPTOSBUFFERS?0:which+1); 
	sprintf(output[which],"%d.%d.%d.%d",p[0],p[1],p[2],p[3]);
	return output[which];
}

c) 开始针对网卡进行抓包

#include "pcap.h"
#pragma comment(lib,"wpcap.lib")
void packet_handler(u_char *param,const struct pcap_pkthdr *header,const u_char *pcap_data);
#define IPTOSBUFFERS 12
void ifprint(pcap_if_t *d);
char * iptos(u_long in);
int i = 0;
int main()
{
	pcap_if_t * alldevs;
	pcap_if_t * d;
	int inum;
	pcap_t * adhandle;
	char errbuf[PCAP_ERRBUF_SIZE];
	/*取得列表*/
	if(pcap_findalldevs(&alldevs,errbuf) == -1)
	{
		exit(1);
	}
	/*输出列表*/
	for(d=alldevs;d != NULL;d=d->next)
	{
		ifprint(d);
	}
	if(i==0)
	{

		printf("\nNo interfaces found!Make sure WinPcap is installed.\n");
		char c = getchar();
		return -1;
	}
	printf("Enter the interface number (1-%d):",i);
	scanf("%d",&inum);
	if(inum <1 || inum >i)
	{
		printf("\nInterface number out of range.\n");
		pcap_freealldevs(alldevs);
		char c = getchar();
		return -1;
	}
	
	//转到选择的设备
	for (d = alldevs,i=0;i <inum-1;d=d->next,i++);
	//打开失败
	if ((adhandle=pcap_open_live(d->name,65536,1,1000,errbuf))==NULL)
	{
		fprintf(stderr,"\nUnable to open the adapter.%s is not supported by WinPcap\n");
		pcap_freealldevs(alldevs);
		char c = getchar();
		return -1;
	}
	printf("\nlistening on %s...\n",d->description);
	//释放列表
	pcap_freealldevs(alldevs);
	//开始捕捉
	pcap_loop(adhandle,0,packet_handler,NULL);
	char c = getchar();
	return 0;
}
void ifprint(pcap_if_t *d)
{
	pcap_addr_t *a;
	printf("%d.%s",++i,d->name);
	if(d->description)
	{
		printf("\tDescription:(%s)\n",d->description);
	}else{
		printf("\t(No description available)\n");
	}
	printf("\tLoopback:%s\n",(d->flags & PCAP_IF_LOOPBACK)?"yes":"no");
	for (a=d->addresses;a != NULL;a=a->next)
	{
		printf("\tAddress Family:#%d\n",a->addr->sa_family);
		switch (a->addr->sa_family)
		{
		case AF_INET:
			printf("\tAddress Family Name:AF_INET\n");
			if(a->addr)
			{
				printf("\tAddress:%s\n",iptos(((struct sockaddr_in *)a->addr)->sin_addr.s_addr));
			}
			if(a->netmask)
			{
				printf("\tNetmask:%s\n",iptos(((struct sockaddr_in *)a->netmask)->sin_addr.s_addr));
			}
			if(a->broadaddr)
			{
				printf("\tBroadcast Address:%s\n",iptos(((struct sockaddr_in *)a->broadaddr)->sin_addr.s_addr));
			}
			if(a->dstaddr)
			{
				printf("\tDestination Address:%s\n",iptos(((struct sockaddr_in *)a->dstaddr)->sin_addr.s_addr));
			}
			break;
		default:
			printf("\tAddressFamilyName:Unknown\n");
			break;
		}
	}
}
char * iptos(u_long in)
{ 
	static char output[IPTOSBUFFERS][3*4+3+1];
	static short which;
	u_char *p; 
	p = (u_char *)&in;
	which=(which+1==IPTOSBUFFERS?0:which+1); 
	sprintf(output[which],"%d.%d.%d.%d",p[0],p[1],p[2],p[3]);
	return output[which];
}
void packet_handler(u_char *param,const struct pcap_pkthdr *header,const u_char *pcap_data)
{
	struct tm * ltime;
	char timestr[16];
	ltime = localtime(&header->ts.tv_sec);
	strftime(timestr,sizeof(timestr),"%H:%M:%S",ltime);
	printf("%s, %.6d len:%d\n",timestr,header->ts.tv_usec,header->len);
}

d) 更详细的抓包

//捕获网络数据包的C++程序
//可以获得数据包长度、通过以太网类型确定上层协议、源以太网地址和目的以太网地址！
#include "pcap.h"
#include<winsock2.h>

#pragma comment(lib,"wpcap.lib")
#pragma comment(lib,"packet.lib")
#pragma comment(lib,"ws2_32.lib")
void packet_handler(u_char *param,const struct pcap_pkthdr *header,const u_char *pcap_data);
#define IPTOSBUFFERS 12
void ifprint(pcap_if_t *d);
char * iptos(u_long in);
int i = 0;
/*以下是以太网协议格式*/
struct ether_header
{
  u_int8_t ether_dhost[6]; //目的Mac地址
  u_int8_t ether_shost[6]; //源Mac地址
  u_int16_t ether_type;    //协议类型
};

struct ip_header
{
  #if defined(WORDS_BIENDIAN)
  u_int8_t   ip_version:4,
             ip_header_length:4;
  #else
  u_int8_t   ip_header_length:4,
             ip_version:4;
  #endif
  u_int8_t    ip_tos;
  u_int16_t   ip_length;
  u_int16_t   ip_id;
  u_int16_t   ip_off;
  u_int8_t    ip_ttl;
  u_int8_t    ip_protocol;
  u_int16_t   ip_checksum;
  struct in_addr ip_souce_address;
  struct in_addr ip_destination_address;
};

void ip_protool_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
  struct ip_header *ip_protocol;
  u_int header_length = 0;
  u_int offset;
  u_char tos;
  u_int16_t checksum;
  //MAC首部是14位的，加上14位得到IP协议首部
  ip_protocol = (struct ip_header *) (packet_content+14);
  checksum =ntohs(ip_protocol->ip_checksum);
  tos = ip_protocol->ip_tos;
  offset = ntohs(ip_protocol->ip_off);
  printf("---------IP协议---------\n");
  printf("版本号:%d\n", ip_protocol->ip_version);
  printf("首部长度:%d\n",header_length);
  printf("服务质量:%d\n",tos);
  printf("总长度:%d\n",ntohs(ip_protocol->ip_length));
  printf("标识:%d\n",ntohs(ip_protocol->ip_id));
  printf("偏移:%d\n",(offset & 0x1fff) * 8);
  printf("生存时间:%d\n",ip_protocol->ip_ttl);
  printf("协议类型:%d\n",ip_protocol->ip_protocol);
  switch (ip_protocol->ip_protocol)
  {
       case 1: printf("上层协议是ICMP协议\n");break;
       case 2: printf("上层协议是IGMP协议\n");break;
       case 6: printf("上层协议是TCP协议\n");break;
       case 17: printf("上层协议是UDP协议\n");break;
       default:break;
  }
  printf("检验和:%d\n",checksum);
  printf("源IP地址:%s\n", inet_ntoa(ip_protocol->ip_souce_address));
  printf("目的地址:%s\n", inet_ntoa(ip_protocol->ip_destination_address));
}

void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr* packet_header,const u_char* packet_content)
{
  u_short ethernet_type;
  struct ether_header *ethernet_protocol;
  u_char *mac_string;
  static int packet_number = 1;
  printf("----------------------------------------------\n");
  printf("捕获第%d个网络数据包\n",packet_number);
  printf("捕获时间:\n");
  printf("%s",ctime((const time_t*)&packet_header->ts.tv_sec));
  printf("数据包长度:\n");
  printf("%d\n",packet_header->len);
  printf("---------以太网协议---------\n");
  ethernet_protocol=(struct ether_header*)packet_content;//获得数据包内容
  printf("以太网类型:\n");
  ethernet_type=ntohs(ethernet_protocol->ether_type);//获得以太网类型
  printf("%04x\n",ethernet_type);
  switch (ethernet_type)
  {
     case 0x0800: printf("上层协议是IP协议\n");break;
     case 0x0806: printf("上层协议是ARP协议\n");break;
     case 0x8035: printf("上层协议是RARP协议\n");break;
     default:break;
  }
  printf("MAC帧源地址:\n");
  mac_string=ethernet_protocol->ether_shost;
  printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
  printf("MAC帧目的地址:\n");
  mac_string=ethernet_protocol->ether_dhost;
  printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
  if(ethernet_type==0x0800)//继续分析IP协议
  {
     ip_protool_packet_callback (argument,packet_header,packet_content);
  }
  printf("----------------------------------------------\n");
  packet_number++;
}

int main()
// {
//      pcap_t* pcap_handle; //winpcap句柄
//      char error_content[PCAP_ERRBUF_SIZE]; //存储错误信息
//      bpf_u_int32 net_mask; //掩码地址
//      bpf_u_int32 net_ip;  //网络地址
//      char *net_interface;  //网络接口
//      struct bpf_program bpf_filter;  //BPF过滤规则
//      char bpf_filter_string[]="ip"; //过滤规则字符串，只分析IPv4的数据包
//      net_interface=pcap_lookupdev(error_content); //获得网络接口
//      pcap_lookupnet(net_interface,&net_ip,&net_mask,error_content); //获得网络地址和掩码地址
//      pcap_handle=pcap_open_live(net_interface,BUFSIZ,1,0,error_content); //打开网络接口
//      pcap_compile(pcap_handle,&bpf_filter,bpf_filter_string,0,net_ip); //编译过滤规则
//      pcap_setfilter(pcap_handle,&bpf_filter);//设置过滤规则
//      if (pcap_datalink(pcap_handle)!=DLT_EN10MB) //DLT_EN10MB表示以太网
//          return 0;
//      pcap_loop(pcap_handle,10,ethernet_protocol_packet_callback,NULL); //捕获10个数据包进行分析
//      pcap_close(pcap_handle);
//      return 0;
// }
{
	pcap_if_t * alldevs;
	pcap_if_t * d;
	int inum;
	pcap_t * adhandle;
	char errbuf[PCAP_ERRBUF_SIZE];
	/*取得列表*/
	if(pcap_findalldevs(&alldevs,errbuf) == -1)
	{
		exit(1);
	}
	/*输出列表*/
	for(d=alldevs;d != NULL;d=d->next)
	{
		ifprint(d);
	}
	if(i==0)
	{

		printf("\nNo interfaces found!Make sure WinPcap is installed.\n");
		char c = getchar();
		return -1;
	}
	printf("Enter the interface number (1-%d):",i);
	scanf("%d",&inum);
	if(inum <1 || inum >i)
	{
		printf("\nInterface number out of range.\n");
		pcap_freealldevs(alldevs);
		char c = getchar();
		return -1;
	}
	
	//转到选择的设备
	for (d = alldevs,i=0;i <inum-1;d=d->next,i++);
	//打开失败
	if ((adhandle=pcap_open_live(d->name,65536,1,1000,errbuf))==NULL)
	{
		fprintf(stderr,"\nUnable to open the adapter.%s is not supported by WinPcap\n");
		pcap_freealldevs(alldevs);
		char c = getchar();
		return -1;
	}
	printf("\nlistening on %s...\n",d->description);
	//释放列表
	pcap_freealldevs(alldevs);
	//开始捕捉
	//pcap_loop(adhandle,0,ip_protool_packet_callback,NULL);
	pcap_loop(adhandle,0,ethernet_protocol_packet_callback,NULL);
	char c = getchar();
	return 0;
}
void ifprint(pcap_if_t *d)
{
	pcap_addr_t *a;
	printf("%d.%s",++i,d->name);
	if(d->description)
	{
		printf("\tDescription:(%s)\n",d->description);
	}else{
		printf("\t(No description available)\n");
	}
	printf("\tLoopback:%s\n",(d->flags & PCAP_IF_LOOPBACK)?"yes":"no");
	for (a=d->addresses;a != NULL;a=a->next)
	{
		printf("\tAddress Family:#%d\n",a->addr->sa_family);
		switch (a->addr->sa_family)
		{
		case AF_INET:
			printf("\tAddress Family Name:AF_INET\n");
			if(a->addr)
			{
				printf("\tAddress:%s\n",iptos(((struct sockaddr_in *)a->addr)->sin_addr.s_addr));
			}
			if(a->netmask)
			{
				printf("\tNetmask:%s\n",iptos(((struct sockaddr_in *)a->netmask)->sin_addr.s_addr));
			}
			if(a->broadaddr)
			{
				printf("\tBroadcast Address:%s\n",iptos(((struct sockaddr_in *)a->broadaddr)->sin_addr.s_addr));
			}
			if(a->dstaddr)
			{
				printf("\tDestination Address:%s\n",iptos(((struct sockaddr_in *)a->dstaddr)->sin_addr.s_addr));
			}
			break;
		default:
			printf("\tAddressFamilyName:Unknown\n");
			break;
		}
	}
}
char * iptos(u_long in)
{ 
	static char output[IPTOSBUFFERS][3*4+3+1];
	static short which;
	u_char *p; 
	p = (u_char *)&in;
	which=(which+1==IPTOSBUFFERS?0:which+1); 
	sprintf(output[which],"%d.%d.%d.%d",p[0],p[1],p[2],p[3]);
	return output[which];
}
void packet_handler(u_char *param,const struct pcap_pkthdr *header,const u_char *pcap_data)
{
	struct tm * ltime;
	char timestr[16];
	ltime = localtime(&header->ts.tv_sec);
	strftime(timestr,sizeof(timestr),"%H:%M:%S",ltime);
	printf("%s, %.6d len:%d\n",timestr,header->ts.tv_usec,header->len);
}