数据包分析
想要知道如何解析IP数据包,就要知道不同的IP数据包的包头结构,于是我们上⽹查查资料:
以太网数据包
ARP数据包
IPv4
IPv6
TCP
UDP
ICMP
ICMPv6
根据以上数据包头结构,我们就有了我们的protocol.h文件,声明各种数据包:
#ifndef PROTOCOL_H
#define PROTOCOL_H
#define HAVE_REMOTE
#define PROTO_ICMP 1
#define PROTO_TCP 6
#define PROTO_UDP 17
#include <iostream>
#include <QObject>
#include "_bsd_types.h"
#include "pcap.h"
using namespace std;
//IPV4
typedef struct ip_address{
u_char byte1;
u_char byte2;
u_char byte3;
u_char byte4;
}ip_address;
typedef struct ipv6_address
{
u_char byte1;
u_char byte2;
u_char byte3;
u_char byte4;
u_char byte5;
u_char byte6;
u_char byte7;
u_char byte8;
}ipv6_address;
typedef struct ipv4_header{
u_char ver_ihl;
u_char tos;
u_short tlen;
u_short Identification;
u_short flags_fo;
u_char ttl;
u_char proto;
u_short crc;
ip_address srcaddr;
ip_address dstaddr;
u_int op_pad;
}ipv4_header;
typedef struct ipv6_header{
u_int ver:4,
flowtype:8,
flowtip:20;
u_short len;
u_char pnext;
u_char lim;
ipv6_address srcaddr;
ipv6_address dstaddr;
}ipv6_header;
typedef struct tcp_header{
u_short srcport;
u_short dstport;
u_int seq;
u_int ack_seq;
u_short resl:4,
doff:4,
fin:1,
syn:1,
pst:1,
psh:1,
ack:1,
urg:1,
ece:1,
cwr:1;
u_short window;
u_short check;
u_short urg_ptr;
u_int opt;
}tcp_header;
typedef struct udp_header{
u_short srcport;
u_short dstport;
u_short tlen;
u_short crc;
}udp_header;
typedef struct icmp_header{
u_char type;
u_char code;
u_char seq;
u_char crc;
}icmp_header;
typedef struct icmp6_header{
u_char type;
u_char code;
u_char seq;
u_char crc;
u_char op_type;
u_char op_len;
u_char op_ethaddr[6];
}icmp6_header;
typedef struct pkg_count{
int n_tcp;
int n_udp;
int n_icmp;
int n_icmp6;
int n_http;
int n_arp;
int n_ipv4;
int n_ipv6;
int n_other;
int n_ttl;
}pkg_count;
typedef struct arp_header{
u_short hardware;
u_short proto;
u_char ml;
u_char ipl;
u_short opt;
u_char sm[6];
ip_address sip;
u_char dm[6];
ip_address dip;
}arp_hearder;
typedef struct eth_header{
u_char smac[6];
u_char dmac[6];
u_short type;
}eth_header;
typedef struct pkg_data
{
QString pkgtype;
int time[6];
int len;
eth_header *ethh;
ipv4_header *ipv4h;
ipv6_header *ipv6h;
arp_header *arph;
udp_header *udph;
tcp_header *tcph;
icmp_header *icmph;
icmp6_header *icmp6;
void *apph;
}pkg_data;
#endif // PROTOCOL_H
再对数据包的结构进行了解后,我们就需要对这些包进行解析,所以我们需要一个packettools类,里面用静态函数写出包的解析,供我们在别的地方调用:
#ifndef PACKETTOOLS_H
#define PACKETTOOLS_H
#include <QObject>
#include <QTextEdit>
#include "protocol.h"
#include "iostream"
using namespace std;
class PacketTools
{
public:
static int unpcak_Frame(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpcak_Arp(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Ip(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Ipv6(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Icmp(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Icmp6(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Tcp(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int unpack_Udp(const u_char *pkg,
pkg_data *data,
pkg_count *pkgCnts);
static int pack_Print(u_char *pkg,
int size,
QTextEdit *edit);
};
#endif // PACKETTOOLS_H
主要一点就是要知道父类数据包的type字段对子类数据包的分类,然后将数据包拷贝储存到全局容器里面。
推荐课程:https://xxetb.xetslk.com/s/3oyV5o