[绝冬城]Sniff C++实现源码解析

 

/*

    by 雪天翔

    2007.9

*/

 

/*

  1、把网卡置于混杂模式

  2、捕获数据包

  3、分析数据包

*/

 

// 定义各种结构体

typedef struct _PROTN2T

{

    int  proto ;

    char *pprototext ;

}PROTN2T ;

                    

#define PROTO_NUM  11

 

/* The IP header */

typedef struct _IPHEADER {

        unsigned char  header_len:4;

        unsigned char  version:4;  

        unsigned char  tos;            // type of service

        unsigned short total_len;      // length of the packet

        unsigned short ident;          // unique identifier

        unsigned short flags;         

        unsigned char  ttl;           

        unsigned char  proto;          // protocol ( IP , TCP, UDP etc)

        unsigned short checksum;      

        unsigned int   sourceIP;

        unsigned int   destIP;

 

}IPHEADER;

 

#define UDP_HEAD_LEN 8   /* UDP head length */

 

#define PSEUDO_HEAD_LEN 12  /* Pseudo head length */

 

#define ICMP_HEAD_LEN 4  /* ICMP head length */

 

struct TCPPacketHead {

    WORD SourPort;

    WORD DestPort;

    DWORD SeqNo;

    DWORD AckNo;

    BYTE HLen;

    BYTE Flag;

    WORD WndSize;

    WORD ChkSum;

    WORD UrgPtr;

};

 

struct ICMPPacketHead {

    BYTE Type;

    BYTE Code;

    WORD ChkSum;

};

 

struct UDPPacketHead {

    WORD SourPort;

    WORD DestPort;

    WORD Len;

    WORD ChkSum;

};

//定义成员变量

    DWORD  m_ipsource     ; //本机IP地址 (IN_ADDR)

    DWORD  m_iphostsource ; // same IP in host format

    DWORD  m_iphost;

    DWORD  m_ipcheckedhost;

    SOCKET m_s            ;

    DWORD  m_threadID     ;

    BOOL   m_Multihomed   ;

    BOOL   m_Local        ;

    CDWordArray m_IPArr   ; //IP队列

 

    friend UINT threadFunc ( LPVOID p ) ;

   

typedef struct _PROTN2T

{

    int  proto ;

    char *pprototext ;

}PROTN2T ;

                    

#define PROTO_NUM  11

 

/* The IP header */

typedef struct _IPHEADER {

        unsigned char  header_len:4;

        unsigned char  version:4;  

        unsigned char  tos;            // type of service

        unsigned short total_len;      // length of the packet

        unsigned short ident;          // unique identifier

        unsigned short flags;         

        unsigned char  ttl;           

        unsigned char  proto;          // protocol ( IP , TCP, UDP etc)

        unsigned short checksum;      

        unsigned int   sourceIP;

        unsigned int   destIP;

 

}IPHEADER;

 

  

#define UDP_HEAD_LEN 8   /* UDP head length */

 

#define PSEUDO_HEAD_LEN 12  /* Pseudo head length */

 

#define ICMP_HEAD_LEN 4  /* ICMP head length */

 

struct TCPPacketHead {

    WORD SourPort;

    WORD DestPort;

    DWORD SeqNo;

    DWORD AckNo;

    BYTE HLen;

    BYTE Flag;

    WORD WndSize;

    WORD ChkSum;

    WORD UrgPtr;

};

 

struct ICMPPacketHead {

    BYTE Type;

    BYTE Code;

    WORD ChkSum;

};

 

struct UDPPacketHead {

    WORD SourPort;

    WORD DestPort;

    WORD Len;

    WORD ChkSum;

};

 

//初始化代码

BOOL CIpmonDlg::OnInitDialog()

{

    CDialog::OnInitDialog();

   

    CHAR       szHostName[128] = { 0};  //主机名

    HOSTENT*   pHost = NULL;           //主机HOSTENT信息

    /*

    struct hostent {

           char FAR *       h_name;    //主机名

           char FAR * FAR * h_aliases; //一个以空指针结尾的可选主机名队列

           short            h_addrtype;   //返回地址的类型，对于Windows Sockets,这个域始终为PF_INET

           short            h_length;  //每个地址的长度（字节数），对应于PF_INET域应该为4

           char FAR * FAR * h_addr_list;  //<