pcap数据包解析及数据特征提取

pcap数据包解析及数据特征提取代码

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<math.h>
#include<time.h>
#pragma pack(1)
#define BUFSIZE 1526
#define STRSIZE 1024

typedef int bpf_int32;
typedef unsigned int bpf_u_int32;
typedef unsigned short  u_short;
typedef unsigned int u_int32;
typedef unsigned short u_int16;
typedef unsigned char u_int8;
//pacp文件头结构体
struct pcap_file_header
{
    bpf_u_int32 magic;
    u_short version_major;
    u_short version_minor;
    bpf_int32 thiszone;
    bpf_u_int32 sigfigs;
    bpf_u_int32 snaplen;
    bpf_u_int32 linktype;
};

//时间戳
struct time_val
{
    bpf_u_int32 tv_sec;
    bpf_u_int32 tv_usec;
};

//pcap数据包头结构体
struct pcap_pkthdr
{
    struct time_val ts;
    bpf_u_int32 caplen;
    bpf_u_int32 len;
};


 //数据帧头
 typedef struct FramHeader_t
 {
     u_int8 DstMAC[6];
     u_int8 SrcMAC[6];
     u_short FrameType;
 } FramHeader_t;

 //IP数据报头
 typedef struct IPHeader_t
 {
     u_int8 Ver_HLen;
     u_int8 TOS;
     u_int16 TotalLen;
     u_int16 ID;
     u_int16 Flag_Segment;
     u_int8 TTL;
     u_int8 Protocol;
     u_int16 Checksum;
     u_int32 SrcIP;
     u_int32 DstIP;
 } IPHeader_t;

//TCP数据报头
 typedef struct TCPHeader_t
 {
     u_int16 SrcPort;
     u_int16 DstPort;
     u_int32 SeqNO;
     u_int32 AckNO;
     u_int8 HeaderLen;
     u_int8 Flags;
     u_int16 Window;
     u_int16 Checksum;
     u_int16 UrgentPointer;
 }TCPHeader_t;

  double log2(double x)
 {
     double z;
     z=log(x)/log(2);
     return z;
 };
 double encropy(int *x,int n,int m)
 {
     double e=0;
     for(int i=0;i<n;i++)
     {
         if(*(x+i)==0)
             continue;
         double f=(double)(*(x+i));
         e=e+(f/m)*log2(m/f);
     }
     return e;
 };


 int main()
 {
    //全局变量定义及初始化
    struct pcap_file_header *file_header;
    struct pcap_pkthdr *ptk_header;
    IPHeader_t *ip_header;
    TCPHeader_t *tcp_header;
    FILE *fp, *fpd,*output;
    char buf[BUFSIZE], my_time[STRSIZE];
     file_header = (struct pcap_file_header *)malloc(sizeof(struct       pcap_file_header));
     ptk_header  = (struct pcap_pkthdr *)malloc(sizeof(struct pcap_pkthdr));
     ip_header = (IPHeader_t *)malloc(sizeof(IPHeader_t));
     tcp_header = (TCPHeader_t *)malloc(sizeof(TCPHeader_t));
     memset(buf, 0, sizeof(buf));
    //全局输出文件定义及初始化
     if((output = fopen("output.txt","w+")) == NULL)
     {
         printf("error: can not open output file\n");
         exit(0);
     }

    for(int n=0;n<60;n++)
    {
        double feature1=0,feature2=0,feature3=0,feature4=0;
        int pkt_offset, pkt_offset_1,i=0,j=0;
        int len_sum1=0,len_sum2=0;
        long time1=0,time2=0;
        int ptk_len=0,num[BUFSIZE]={0};
        int seg1=0,seg2=0,seg_num=0;
        char file1[32],file2[32];
        //打开数据包
        sprintf(file1,"douyu_up/douyu_up_%d.pcap",n);
        sprintf(file2,"douyu_down/douyu_down_%d.pcap",n);
        if((fp = fopen(file1,"r")) == NULL)
         {
             printf("error: can not open pcap file\n");
             exit(0);
         }
        if((fpd = fopen(file2,"r")) == NULL)
         {
             printf("error: can not open pcap file\n");
             exit(0);
         }

        //数据1解析
         pkt_offset = 24;
         while(fseek(fp, pkt_offset, SEEK_SET) == 0)
         {
             i++;
            //数据读取
             if(fread(ptk_header, 16, 1, fp) != 1)
             {
                 printf("\nread end of pcap file\n");
                 break;
             }
             fseek(fp, 14, SEEK_CUR);
             if(fread(ip_header, sizeof(IPHeader_t), 1, fp) != 1)
             {
                 printf("%d: can not read ip_header\n", i);
             }
            if(fread(tcp_header, sizeof(TCPHeader_t), 1, fp) != 1)
             {
                 printf("%d: can not read tcp_header\n", i);
             }
            //结果运算
            pkt_offset=pkt_offset+ptk_header->len+16;
            len_sum1=len_sum1+ptk_header->len+16;
         }

        //数据2解析
         pkt_offset_1 = 24;
         while(fseek(fpd, pkt_offset_1, SEEK_SET) == 0)
         {
             j++;
            //数据读取
             if(fread(ptk_header, 16, 1, fpd) != 1)
             {
                 printf("\nread end of pcap file\n");
                 break;
             }
             fseek(fpd, 14, SEEK_CUR);
             if(fread(ip_header, sizeof(IPHeader_t), 1, fpd) != 1)
             {
                 printf("%d: can not read ip_header\n", j);
             }
            if(fread(tcp_header, sizeof(TCPHeader_t), 1, fpd) != 1)
             {
                 printf("%d: can not read tcp_header\n", j);
             }
            //结果运算
            pkt_offset_1=pkt_offset_1+ptk_header->len+16;

            len_sum2=len_sum2+ptk_header->len+16;

             time1= (long)(ptk_header->ts.tv_sec)*1000000+(long)(ptk_header->ts.tv_usec);
             if(j==1)
             {
                 time2=time1;
             }

             ptk_len=ptk_header->len;
             num[ptk_len]++;

            seg2=ip_header->SrcIP;
            if(seg_num==0)
            {
                seg1=ip_header->SrcIP;
                seg_num++;
            }
            if(seg1!=seg2)
            {
                seg_num++;
                seg1=seg2;
            }
         }

         //综合
         feature1= (double)len_sum2/(double)len_sum1;
         feature2=(double)(time1-time2)/j;
         feature3=encropy(num,BUFSIZE,j);
         feature4=log((double)seg_num);
         fprintf(output,"上行流量与下行流量的比值：%f\n平均到达时间：%f\n熵：%f\n下行字段数：%f\n上行包数： %d\n下行包数：%d\n",feature1,feature2,feature3,feature4,i,j);

        fclose(fpd);
        fclose(fp);
    }
    fclose(output);
    return 0;
 }

如有问题,欢迎提问.