网络流量监视 之三

    上篇网络流量监视 之二 写到通过raw socket捕获到了包括IP头数据包，下面的工作就是分析该数据包了

    数据包结构很多地方都有介绍的，具体如下

    ----------------------------------------------

　　| ip header | tcp header(or x header) | data |

　　----------------------------------------------

    其中IP头部分如下

 0                   1                   2                   3

    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |Version|  IHL  |Type of Service|          Total Length         |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |         Identification        |Flags|      Fragment Offset    |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |  Time to Live |    Protocol   |         Header Checksum       |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |                       Source Address                          |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |                    Destination Address                        |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   |                    Options                    |    Padding    |

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 

    数据结构定义如下（IPV4）：

[StructLayout(LayoutKind.Sequential, Pack = 1)] public struct IPHeader { [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_verlen; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_tos; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_totallength; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_id; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_offset; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_ttl; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_protocol; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_checksum; [MarshalAs(UnmanagedType.U4, SizeConst = 4)] public uint ip_srcaddr; [MarshalAs(UnmanagedType.U4, SizeConst = 4)] public uint ip_destaddr; } 

    把2进制数据转换成对应的数据结构，使用以下的转换函数

public static unsafe T ByteBufferToStruct<T>(byte[] data) { IntPtr ip = Marshal.AllocHGlobal(data.Length); //WARNING: ALLOCATING UNMANAGED MEMORY! Marshal.Copy(data, 0, ip, data.Length); T o = (T)Marshal.PtrToStructure(ip, typeof(T)); Marshal.FreeHGlobal(ip); //UNALLOCATE - DO NOT REMOVE THIS!!!!! return o; }

    转换完成的数据并不能直接使用，熟悉网络的人应该知道，IP包头采用的是网络字节序，需要转换成对应的本机字节序，对于ushort类型的数据，需要将高低位字节进行交换

  public static uint NetworkToHostOrder(uint val) { byte[] array = BitConverter.GetBytes(val); Array.Reverse(array); return BitConverter.ToUInt32(array, 0); }

 

    下面一一列举数据结构各个字段的意义：

 

    一  ip_verlen，前4位存放着IP的版本号，后4位存放着IP头长度

    通过 ip_verlen >> 4 得到值来判断数据包的IP协议版本号（4或者是6）

    通过 ip_verlen & 0x0f 得到IP包头长度（注意该值需要乘4才是包头长度）

 

    二  ip_tos，服务器类型 ，本文不使用

    三  ip_totallength，数据包长度

 

    四  ip_id， 16位标识 

 

    五  ip_offset， 分片偏移， 其前3位为标识

 

    六  ip_ttl，8位生存时间 TTL 

 

    七  ip_protocol，8位协议 (TCP, UDP 或其他) 

 

    八  ip_checksum，16位IP首部校验和 

 

    九  ip_srcaddr，32位源IP地址 

 

    十  ip_destaddr ，32位目的IP地址 

 

 

    下面是实现IP头解析的代码

/* * Created by SharpDevelop. * Coding by P-wang * Date: 2010/05/25 * Time: 16:46 * */ using System; using System.Net; using System.Runtime.InteropServices; using System.Text; namespace NetworkMonitor2 { public enum Protocol { ICMP = 1, IGMP = 2, TCP = 6, UDP = 17, Unknown = -1 }; [StructLayout(LayoutKind.Sequential, Pack = 1)] public struct IPHeader { [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_verlen; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_tos; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_totallength; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_id; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_offset; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_ttl; [MarshalAs(UnmanagedType.U1, SizeConst = 1)] public byte ip_protocol; [MarshalAs(UnmanagedType.U2, SizeConst = 2)] public ushort ip_checksum; [MarshalAs(UnmanagedType.U4, SizeConst = 4)] public uint ip_srcaddr; [MarshalAs(UnmanagedType.U4, SizeConst = 4)] public uint ip_destaddr; } /// <summary> /// Description of PackageHeader. /// </summary> public class PackageIP { private IPHeader m_header; private byte[] m_data; private int m_nHeadLength; private int m_packagelength; public PackageIP(byte[] buffer, int startpos, int datalen) { m_packagelength = datalen; m_header = GetIPHeader(buffer, startpos, datalen); m_header.ip_totallength = NetworkToHostOrder(m_header.ip_totallength); m_header.ip_id = NetworkToHostOrder(m_header.ip_id); m_header.ip_offset = NetworkToHostOrder(m_header.ip_offset); m_header.ip_checksum = NetworkToHostOrder(m_header.ip_checksum); m_nHeadLength = m_header.ip_verlen; m_nHeadLength &= 0x0f; m_nHeadLength *= 4;//Multiply by four to get the exact header length m_data = new byte[m_header.ip_totallength - m_nHeadLength]; Buffer.BlockCopy(buffer, startpos + m_nHeadLength, m_data, 0, m_data.Length); } public string Version { get{ if ((m_header.ip_verlen >> 4) == 4){ return "IP v4"; } else if ((m_header.ip_verlen >> 4) == 6){ return "IP v6"; } else{ return "Unknown"; } } } public string HeaderLength { get{ return m_nHeadLength.ToString(); } } public ushort MessageLength { get{ return (ushort)(m_header.ip_totallength - m_nHeadLength); } } public string DifferentiatedServices { get{ return string.Format ("0x{0:x2} ({1})", m_header.ip_tos,m_header.ip_tos); } } public string Flags { get{ int nFlags = m_header.ip_offset >> 13; if (nFlags == 2){ return "Don't fragment"; } else if (nFlags == 1){ return "More fragments to come"; } else{ return nFlags.ToString(); } } } public string FragmentationOffset { get{ int nOffset = m_header.ip_offset & 0x07ff; return nOffset.ToString(); } } public string TTL { get{ return m_header.ip_ttl.ToString(); } } public Protocol ProtocolType { get{ switch(m_header.ip_protocol) { case 1: case 2: case 6: case 17: return (Protocol)m_header.ip_protocol; default: return Protocol.Unknown; } } } public string Checksum { get{ return string.Format ("0x{0:x2}", m_header.ip_checksum); } } public IPAddress SourceAddress { get{ return new IPAddress(m_header.ip_srcaddr); } } public IPAddress DestinationAddress { get{ return new IPAddress(m_header.ip_destaddr); } } public string TotalLength { get{ return m_header.ip_totallength.ToString(); } } public string Identification { get{ return m_header.ip_id.ToString(); } } public override string ToString() { StringBuilder ret = new StringBuilder(); ret.AppendLine(string.Format("/t/t Version:{0}", Version)); ret.AppendLine(string.Format("/t/t HeaderLength:{0}", HeaderLength)); ret.AppendLine(string.Format("/t/t TotalLength:{0}", TotalLength)); ret.AppendLine(string.Format("/t/t MessageLength:{0}", MessageLength)); ret.AppendLine(string.Format("/t/t TOS:{0}", DifferentiatedServices)); ret.AppendLine(string.Format("/t/t Identification:{0}", Identification)); ret.AppendLine(string.Format("/t/t Flags:{0}", Flags)); ret.AppendLine(string.Format("/t/t FragmentationOffset:{0}", FragmentationOffset)); ret.AppendLine(string.Format("/t/t TTL:{0}", TTL)); ret.AppendLine(string.Format("/t/t ProtocolType:{0}", ProtocolType)); ret.AppendLine(string.Format("/t/t Checksum:{0}", Checksum)); ret.AppendLine(string.Format("/t/t SourceAddress:{0}", SourceAddress)); ret.AppendLine(string.Format("/t/t DestinationAddress:{0}", DestinationAddress)); return ret.ToString(); } const int Size_IPHeader = 18; private static IPHeader GetIPHeader(byte[] buffer, int startpos, int datalen) { if(datalen < Size_IPHeader) throw new ArgumentException("data length error"); byte[] tmpdata = new byte[datalen]; Buffer.BlockCopy(buffer, startpos, tmpdata, 0, datalen); return ByteBufferToStruct<IPHeader>(tmpdata); } public static unsafe byte[] StructToByteBuffer(object o) { int size = Marshal.SizeOf(o); IntPtr ip = Marshal.AllocHGlobal(size); //WARNING: ALLOCATING UNMANAGED MEMORY! Marshal.StructureToPtr(o, ip, false); byte[] buffer = new byte[size]; Marshal.Copy(ip, buffer, 0, size); Marshal.FreeHGlobal(ip); //UNALLOCATE - DO NOT REMOVE THIS!!!!! return buffer; } public static unsafe T ByteBufferToStruct<T>(byte[] data) { IntPtr ip = Marshal.AllocHGlobal(data.Length); //WARNING: ALLOCATING UNMANAGED MEMORY! Marshal.Copy(data, 0, ip, data.Length); T o = (T)Marshal.PtrToStructure(ip, typeof(T)); Marshal.FreeHGlobal(ip); //UNALLOCATE - DO NOT REMOVE THIS!!!!! return o; } public static ushort NetworkToHostOrder(ushort val) { byte[] array = BitConverter.GetBytes(val); Array.Reverse(array); return BitConverter.ToUInt16(array, 0); } } }

    在网络流量监视 之二 的基础上，增加相关代码，把IP头的解析信息也写入到日志文件中

internal override void OnReceiveData(SocketSession state) { Logger(loglvl.info, "Receive Data:/r/n" + GetHexString(state.m_buffer, state.m_datalen)); PackageIP packhead = new PackageIP(state.m_buffer, 0, state.m_datalen); Logger(loglvl.info, "Package Information:/r/n" + packhead.ToString()); }

    让我们看看效果吧

 

OK，已经可以看到捕获包的基本IP信息了，利用这些信息，我们可以在网络流量监视 之一的基础上对网络数据流量进行更加详细的监视了。