<?php
require_once 'XByteArray.php';
require_once 'http.php';
class MyPacket
{
public $port_src = 0;
public $ip_src = 0;
public $port_dst = 0;
public $ip_dst = 0;
public $tcp_flags = 0;
public $tcp_flags_res = 0;
public $tcp_flags_ns = 0;
public $tcp_flags_cwr = 0;
public $tcp_flags_ecn = 0;
public $tcp_flags_urg = 0;
public $tcp_flags_ack = 0;
public $tcp_flags_reset = 0;
public $tcp_flags_syn = 0;
public $tcp_flags_fin = 0;
public $tcp_flags_push = 0;
public $data = "";
public $timestamp = 0;
public $timestamp_name = "";
public $key = "";
public $frame_num= 0;
public $frame_len=0;
public $frame_caplen=0;
public function genKey()
{
$keyarr =array($this->ip_src.":".$this->port_src, $this->ip_dst.":".$this->port_dst);
sort($keyarr,SORT_STRING);
$this->key = implode("<->",$keyarr);
}
public function dump()
{
printf("%10d ", $this->frame_num);
echo $this->timestamp;
echo " {$this->ip_src}";
echo ":{$this->port_src}";
echo "->{$this->ip_dst}";
echo ":{$this->port_dst}";
printf(" len %5d ", $this->frame_len);
printf(" caplen %5d ", $this->frame_caplen);
echo " flags ". dechex($this->tcp_flags);
echo " res {$this->tcp_flags_res}";
echo " ns {$this->tcp_flags_ns}";
echo " cwr {$this->tcp_flags_cwr}";
echo " ecn {$this->tcp_flags_ecn}";
echo " urg {$this->tcp_flags_urg}";
echo " ack {$this->tcp_flags_ack}";
echo " reset {$this->tcp_flags_reset}";
echo " syn {$this->tcp_flags_syn}";
echo " fin {$this->tcp_flags_fin}";
echo " push {$this->tcp_flags_push}";
echo " data:".strlen($this->data);
echo "\n";
}
};
class MyHttpRequestAndResponse
{
const STAT_NONE =0;
const STAT_REQUEST_FIRST_SENT =1;
const STAT_REQUEST_FIRST_SENT_ACK =2;
const STAT_REQUEST_LAST_SENT =4;
const STAT_REQUEST_LAST_SENT_ACK =8;
const STAT_RESPONSE_FIRST_RECEIVED =16;
const STAT_RESPONSE_FIRST_RECEIVED_ACK =32;
const STAT_RESPONSE_LAST_RECEIVED =64;
const STAT_RESPONSE_LAST_RECEIVED_ACK =128;
public $host = "";
public $url = "";
public $begin_time ="";
public $request_sent_first_packet_timestamp =0;
public $request_sent_first_packet_ack_timestamp =0;
public $request_sent_last_packet_timestamp =0;
public $request_sent_last_packet_ack_timestamp =0;
public $response_first_packet_timestamp =0;
public $response_first_packet_ack_timestamp =0;
public $response_last_packet_timestamp =0;
public $response_last_packet_ack_timestamp=0;
public $request_data_length=0;
public $response_data_length=0;
public $stat = 0;
public $need_send_ack = 0;
public $reqdata='';
public $mypacketlist = array();
};
class MyConnection
{
const STAT_SENDING_REQUEST = 0;
const STAT_WATTING_RESPONSE = 1;
public $packetlist = array();
public $client_ip ="";
public $client_port ="";
public $server_ip ="";
public $server_port ="";
public function analize()
{
if($this->packetlist[0]->tcp_flags!=0x02)
{
echo "legacy connection ".$this->packetlist[0]->key." \n";
return ;
}
if(count($this->packetlist)<3 || $this->packetlist[1]->tcp_flags!=0x12 || $this->packetlist[2]->tcp_flags!=0x10)
{
echo "connection ".$this->packetlist[0]->key." not establish \n";
}
$connect_ack_cost = $this->packetlist[1]->timestamp - $this->packetlist[0]->timestamp;
$connect_total_cost = $this->packetlist[2]->timestamp - $this->packetlist[0]->timestamp;
echo "CONNECT(".$this->packetlist[0]->key.") COST: $connect_total_cost($connect_ack_cost) \n" ;
$ctx = new HttpContext();
$bufs = new XAutoBuffer(4096);
$stat = MyConnection::STAT_SENDING_REQUEST;
$collectorlist = array();
$collector = new MyHttpRequestAndResponse();
for($i=3;$i<count($this->packetlist);$i++)
{
$packet = $this->packetlist[$i];
array_push($collector->mypacketlist,$packet);
if($packet->tcp_flags_ack)
{
switch($collector->stat)
{
case MyHttpRequestAndResponse::STAT_REQUEST_FIRST_SENT:
case MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT:
if(!($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
{
if($collector->request_sent_first_packet_ack_timestamp==0)
{
$collector->request_sent_first_packet_ack_timestamp = $packet->timestamp;
}
if($collector->need_send_ack==1)
{
$collector->request_sent_last_packet_ack_timestamp = $packet->timestamp;
$collector->stat =MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT_ACK;
}
$collector->need_send_ack --;
}
break;
case MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED:
if(($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
{
$collector->response_first_packet_ack_timestamp = $packet->timestamp;
$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED_ACK;
}
break;
case MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED:
if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
{
$collector->response_last_packet_ack_timestamp = $packet->timestamp;
$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED_ACK;
array_push($collectorlist,$collector);
$collector = new MyHttpRequestAndResponse();
}
break;
}
}
if(strlen($packet->data)>0)
{
if($this->client_ip=="")
{
$this->client_ip = $packet->ip_src;
$this->client_port = $packet->port_src;
$this->server_ip = $packet->ip_dst;
$this->server_port = $packet->port_dst;
}
//截包缺失处理
if($stat==MyConnection::STAT_SENDING_REQUEST)
{
if(!($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
{
$collector->request_sent_last_packet_timestamp = $packet->timestamp;
$collector->request_data_length = $bufs->GetLength();
$collector->url = $ctx->m_header->status_code;
$collector->host = $ctx->getHeaderValueByName('Host');
$ctx->reset();
$bufs->Clear();
}
}
else
{
if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
{
$collector->stat = MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED;
$collector->response_last_packet_timestamp = $packet->timestamp;
$collector->response_data_length = $bufs->GetLength();
$collector->response_last_packet_ack_timestamp = $packet->timestamp;
$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED_ACK;
array_push($collectorlist,$collector);
$collector = new MyHttpRequestAndResponse();
$ctx->reset();
$bufs->Clear();
}
}
if($collector->stat == MyHttpRequestAndResponse::STAT_NONE )
{
$collector->stat = MyHttpRequestAndResponse::STAT_REQUEST_FIRST_SENT;
$collector->begin_time = $packet->timestamp_name;
$collector->request_sent_first_packet_timestamp = $packet->timestamp;
}
if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
{
$collector->need_send_ack ++;
}
else
{
if($collector->stat < MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED)
{
if($collector->request_sent_last_packet_ack_timestamp==0)
{
$collector->request_sent_last_packet_ack_timestamp = $collector->request_sent_first_packet_ack_timestamp;
}
$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED;
$collector->response_first_packet_timestamp = $packet->timestamp;
}
}
$bytetotal = strlen($packet->data);
$consumeLen =0;
$consumeLen = HttpProtocolClient::parseHttp($ctx,$packet->data,$bytetotal,$bufs);
if($consumeLen!=$bytetotal)
{
// var_dump($ctx);
echo "error $consumeLen!=$bytetotal , it is not ok in http\n";
//$of = fopen("/tmp/httpdata.dump", "wb");
for($k=0;$k<count($collector->mypacketlist);$k++)
{
$collector->mypacketlist[$k]->dump();
// $datalen = strlen($collector->mypacketlist[$k]->data);
// if($datalen>0)
// {
// fwrite($of, $collector->mypacketlist[$k]->data, strlen($collector->mypacketlist[$k]->data));
// }
}
//fclose($of);
//exit(0);
}
if($ctx->m_state==HttpProtocolClient::PACKET_COMPLETE)
{
if($stat==MyConnection::STAT_SENDING_REQUEST)
{
$stat=MyConnection::STAT_WATTING_RESPONSE;
//echo "request data sent: ". $packet->timestamp_name. ": ". $ctx->m_header->status_code . "\n";
}
else
{
//echo "response data recv: ". $packet->timestamp_name. ": ". $ctx->m_header->status_code . "\n";
$stat=MyConnection::STAT_SENDING_REQUEST;
}
if($collector->stat < MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED )
{
$collector->stat = MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT;
$collector->request_sent_last_packet_timestamp = $packet->timestamp;
$collector->request_data_length = $bufs->GetLength();
$collector->url = $ctx->m_header->status_code;
$collector->host = $ctx->getHeaderValueByName('Host');
$collector->reqdata = $bufs->GetBuffer();
}
else
{
$collector->stat = MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED;
$collector->response_last_packet_timestamp = $packet->timestamp;
$collector->response_data_length = $bufs->GetLength();
}
//var_dump($packet);
//var_dump($ctx);
$ctx->reset();
$bufs->Clear();
}
}
}
if(count($collectorlist)==0)
{
for($i=0;$i<count($this->packetlist);$i++)
{
$this->packetlist[$i]->dump();
}
}
else
{
// for($i=0;$i<3;$i++)
// {
// $this->packetlist[$i]->dump();
// }
foreach($collectorlist as $c)
{
printf("%0.3f REQUEST TOTAL:%0.3f WRITTEN: %0.3f RESPONSE_FIRST:%0.3f READ: %.3f DATA:%6d URL: %s d:%s\n",
$c->request_sent_first_packet_timestamp,
$c->response_last_packet_ack_timestamp - $c->request_sent_first_packet_timestamp, //TOTAL
$c->request_sent_last_packet_ack_timestamp- $c->request_sent_first_packet_timestamp, //WRITTEN
$c->response_first_packet_timestamp - $c->request_sent_last_packet_ack_timestamp, //RESPONSE_FIRST
$c->response_last_packet_timestamp - $c->response_first_packet_timestamp, //READ
$c->response_data_length, //time
$c->host . $c->url, //url
$c->reqdata
);
// for($i=0;$i<count($c->mypacketlist); $i++)
// {
// $c->mypacketlist[$i]->dump();
// }
}
}
echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n";
//var_dump($collectorlist);
}
};
$connections = array();
$doc = simplexml_load_file("xxxxxx");
$simle_packets = array();
foreach($doc->packet as $packet)
{
$mypacket = new MyPacket();
foreach($packet->proto as $proto)
{
if($proto->attributes()->name=='tcp')
{
foreach($proto->field as $field)
{
$attrs = $field->attributes();
if($attrs->name=="tcp.srcport")
$mypacket->port_src = strval($attrs->show);
else if($attrs->name=="tcp.dstport")
$mypacket->port_dst = strval($attrs->show);
else if($attrs->name=="tcp.flags")
{
$mypacket->tcp_flags = hexdec($attrs->show);
foreach($field->field as $flag)
{
$fatt = $flag->attributes();
if($fatt->name=="tcp.flags.fin")
{
$mypacket->tcp_flags_fin = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.ack")
{
$mypacket->tcp_flags_ack = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.syn")
{
$mypacket->tcp_flags_syn = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.reset")
{
$mypacket->tcp_flags_reset = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.push")
{
$mypacket->tcp_flags_push = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.urg")
{
$mypacket->tcp_flags_urg = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.ecn")
{
$mypacket->tcp_flags_ecn = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.cwr")
{
$mypacket->tcp_flags_cwr = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.ns")
{
$mypacket->tcp_flags_ns = intval($fatt->value);
}
else if($fatt->name=="tcp.flags.res")
{
$mypacket->tcp_flags_res = intval($fatt->value);
}
}
}
// else if($attrs->name=="tcp.data")
// {
// $xtmp = str_replace(':',' ',$attrs->show);
// $mypacket->data = HexStringToBytes($xtmp, strlen($xtmp));
// }
}
}
else if($proto->attributes()->name=='ip')
{
foreach($proto->field as $field)
{
$attrs = $field->attributes();
if($attrs->name=="ip.src")
$mypacket->ip_src = strval($attrs->show);
else if($attrs->name=="ip.dst")
$mypacket->ip_dst = strval($attrs->show);
}
}
else if($proto->attributes()->name=='geninfo')
{
foreach($proto->field as $field)
{
$attrs = $field->attributes();
if($attrs->name=="timestamp")
{
$mypacket->timestamp = doubleval($attrs->value);
$mypacket->timestamp_name = strval($attrs->show);
}
else if($attrs->name=="num")
{
$mypacket->frame_num = hexdec($attrs->value);
}
else if($attrs->name=="len")
{
$mypacket->frame_len = hexdec($attrs->value);
}
else if($attrs->name=="caplen")
{
$mypacket->frame_caplen = hexdec($attrs->value);
}
}
}
else if($proto->attributes()->name=='fake-field-wrapper')
{
foreach($proto->field as $field)
{
$attrs = $field->attributes();
if($attrs->name=="data")
{
$mypacket->data = HexStringToBytes(strval($attrs->value), strlen($attrs->value));
}
}
}
}
$mypacket->genKey();
if(!isset($connections[$mypacket->key]))
{
$connections[$mypacket->key] = new MyConnection();
}
array_push($connections[$mypacket->key]->packetlist,$mypacket);
}
foreach($connections as $k=>$v)
{
//echo "packet number : ". count($v->packetlist) . "\n";
// for($i=0;$i<count($v->packetlist);$i++)
// {
// $v->packetlist[$i]->dump();
// }
//if(strpos($v->packetlist[0]->key, "53777"))
$v->analize();
}
wiresharp截包pdml文件分析php程序
最新推荐文章于 2021-12-21 23:25:54 发布