pcap4j使用教程

kownculture

于 2023-10-17 11:27:19 发布

阅读量995

点赞数 1

文章标签：安全威胁分析 java

本文链接：https://blog.csdn.net/qq_45373631/article/details/133880016

版权

pcap4j使用教程

简介：

是java语言中用于分析事实流量和分析离线流量的封装工具。

官方地址：

GitHub - kaitoy/pcap4j: A Java library for capturing, crafting, and sending packets.

使用：

maven依赖：

 <dependencies>
    <dependency>
      <groupId>org.pcap4j</groupId>
      <artifactId>pcap4j-core</artifactId>
      <version>1.8.2</version>
    </dependency>
    <dependency>
      <groupId>org.pcap4j</groupId>
      <artifactId>pcap4j-packetfactory-static</artifactId>
      <version>1.8.2</version>
    </dependency>
  </dependencies>

实例代码：

String prop = System.getProperty("jna.library.path");
        if (prop == null || prop.isEmpty()) {
            prop = "C:/Windows/System32/Npcap";
        } else {
            prop += ";C:/Windows/System32/Npcap";
        }
        System.setProperty("jna.library.path", prop);
        String[] request_result = new String[65535];
        String[] response_result = new String[65535];
        String result="";
        PcapHandle handle = null;

        try {
            handle = Pcaps.openOffline("D:\\pythonProject\\pythonProject\\Test\\a.pcapng");
            //handle = Pcaps.openOffline("C:\\Users\\admin\\Downloads\\puhuo.pcapng");
            Packet packet;
            int i=3;
            int k=0;
            int m=0;
            int n=0;
            while ((packet = handle.getNextPacket()) != null) {
                    if (packet.contains(IpPacket.class)){
                        EthernetPacket Ethernet_packets = packet.get(EthernetPacket.class);
                        IpV4Packet Ipv4_packet = Ethernet_packets.get(IpV4Packet.class);
                        TcpPacket Tcp_packet = Ipv4_packet.get(TcpPacket.class);
                        if(Tcp_packet.getPayload()!=null)
                        {
                            byte[] payloadbytes = Tcp_packet.getPayload().getRawData();
                            String payloadString = new String(payloadbytes);
                            if (i%3!=0) {
//                                    System.out.println(payloadString);
//                                    if(k%2==1)
//                                    {
//                                        request_result[m]=payloadString;
//                                        m++;
//                                        //System.out.println(payloadString);
//                                    }else if(k%2==0)
//                                    {
//                                        //System.out.println(payloadString);
//                                        response_result[n]=payloadString;
//                                        n++;
//                                    }
//                            k++;
                            }
                            i++;
                                //System.out.println(payloadString);
                            result=result+payloadString;

                        }
                    }

            }
            result=result+"POST";
            System.out.println(result);
            //寻找请求
            Pattern req_pattern = Pattern.compile("(?<=\\r\\n\\r\\n).*?\\S(?=HTTP/1.1)");
            Matcher req_matcher = req_pattern.matcher(result);
            while (req_matcher.find()) {
                System.out.println("请求数据：" + req_matcher.group());
            }
            //寻找响应
             Pattern resp_pattern = Pattern.compile("(?<=\\r\\n\\r\\n).*?(?=POST)");
             Matcher resp_matcher = resp_pattern.matcher(result);
             while (resp_matcher.find()) {
                System.out.println("响应数据：" + resp_matcher.group());
            }
        } catch (PcapNativeException e) {
            throw new RuntimeException(e);
        } catch (NotOpenException e) {
            throw new RuntimeException(e);
        }