一个简单嗅探器的实现

这是最近的一段代码。

也没有什么好说的，简单的socket编程，设置网卡为混杂模式，接受所有封包，并打印所有封包的基本信息，及内容。

#include<stdio.h> #include<winsock2.h> #include<string.h> #include<windows.h> #include<mstcpip.h> #pragma comment(lib,"ws2_32.lib") #define RECVPORT 7000 //绑定的接包端口号 struct iphdr { unsigned char head; unsigned char tos; unsigned short length; //IP包头定义 unsigned short flags; unsigned short offset; unsigned char ttl; unsigned char protc; unsigned short checksum; unsigned int sourceip; unsigned int destip; }; struct udphdr { unsigned int sourceport; unsigned int destport; unsigned int length; //UDP包头定义 unsigned int checksum; }; struct tcphdr { USHORT sourceport; USHORT destport; unsigned int seq; unsigned int ack; //TCP包头定义 unsigned char offset; unsigned char flags; USHORT win; USHORT checksum; USHORT urg; }; FILE *f; char orig[100],*p,end; char type[20]={0},version[20]={0},plat[20]={0},ttl[20]={0},win[20]={0},df[20]={0},tos[20]={0}; int i=0,j=0; int ttli,dfi,tosi,winb,wine; bool winf=false; int solve(char *buff) //解包函数定义 { struct iphdr *ip; struct tcphdr *tcp; struct udphdr *udp; struct sockaddr_in test1,test2; BYTE *datat=NULL,*datau=NULL; BYTE test; ip=(struct iphdr*)buff; //取IP头 tcp=(struct tcphdr*)(buff+((ip->head)&0xf)*sizeof(unsigned int)); //取TCP头 udp=(struct udphdr*)(buff+((ip->head)&0xf)*sizeof(unsigned int)); //取UDP头 test1.sin_addr.s_addr=ip->sourceip; test2.sin_addr.s_addr=ip->destip; datat=((BYTE *)tcp)+(tcp->offset>>4)*4; datau=(BYTE *)udp; printf("从:%s,",inet_ntoa(test1.sin_addr)); printf("到:%s\n",inet_ntoa(test2.sin_addr)); switch(ip->protc) { case 1:printf("Proto ICMP,");break; case 2:printf("Proto IGMP,");break; case 6:printf("Proto TCP,");break; case 8:printf("Proto EGP,");break; case 9:printf("Proto IGP,");break; case 17:printf("Proto UDP,");break; case 41:printf("Proto IPv6,");break; case 89:printf("Proto OSPF,");break; default:printf("Proto error,");break; } if(ip->protc==6) { int port=0; port=ntohs(tcp->sourceport); printf("从TCP端口:%d,到TCP端口:%d,SEQ:%d,ACK:%d\n",ntohs(tcp->sourceport),ntohs(tcp->destport),ntohl(tcp->seq),ntohl(tcp->ack)); switch(port) { case 21:printf("这是一个ftp协议数据包\n");break; case 80:printf("这是一个HTTP协议数据包\n");break; case 110:printf("这是一个pop3协议数据包\n");break; case 25:printf("这是一个SMTP协议数据包\n ");break; } printf("FLAGS:"); if(tcp->flags&0x20) printf("URG "); if(tcp->flags&0x10) printf("ACK "); if(tcp->flags&0x8) //对TCP命令，输出标志位 printf("PSH "); if(tcp->flags&0x4) printf("RST "); if(tcp->flags&0x2) printf("SYN "); if(tcp->flags&0x1) printf("FIN "); printf("data:%s\n",datat); } else if(ip->protc==17) { printf("从UDP端口:%d,到UDP端口:%d,\nDATA:%s",ntohs(udp->sourceport),ntohs(udp->destport),datau); } printf("TTL:%d\n",ip->ttl); printf("\n"); return 0; } int main() { WSADATA ws; long lresult; SOCKET sock; struct sockaddr_in myaddress; //定义主函数变量 struct hostent *host; char name[100],buffer[65535],k; int err1,err2,err3,i; printf("输入ENTER键开始\n"); k=getchar(); lresult=WSAStartup(MAKEWORD(2,2),&ws); if(lresult<0) printf("error!"); myaddress.sin_family=AF_INET; myaddress.sin_port=htons(RECVPORT); //初始化 gethostname(name,sizeof(name)); host=gethostbyname(name); memcpy(&myaddress.sin_addr,host->h_addr_list[0],host->h_length); sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP); err2=bind(sock,(PSOCKADDR)&myaddress,sizeof(myaddress)); //绑定端口 if(err2<0) { printf("BIND ERROR!"); exit(1); } DWORD inbuffer=1; DWORD outbuffer[10]; DWORD returned=0; err1=WSAIoctl(sock,SIO_RCVALL,&inbuffer,sizeof(inbuffer),&outbuffer,sizeof(outbuffer),&returned,NULL,NULL); if(err1<0) { printf("IO OPTION SET ERROR!"); //设置端口为接收所有包模式 exit(1); } for(i=1;i<=30;i++) { memset(buffer,0,sizeof(buffer));//清空接收缓冲区 err3=recv(sock,buffer,sizeof(buffer),0); //接包 if(err3<0) { printf("RECEIVE ERROR!"); exit(1); } solve(buffer); //定义解包函数解包 } return 0; }

菜鸟言论，仅供娱乐。