Qt 抓包 检测第三方应用登录（只检测本地网卡 排除虚拟网卡 和无线网卡）

场景：客户端收到指令，启动第三方应用，但是第三方应用的登录状态未知，而客户端需要根据这个状态来进行下一步操作

方案：利用winPcap 抓包，根据抓到的数据来判断第三方应用的登录状态

1，winpCap 配置 

winpcap在VS2012 Qt5 X64下的配置_Persisterfan的博客-CSDN博客

2，写一个类 用来检测

#ifndef SYSTEMAPI_H
#define SYSTEMAPI_H

#include <QObject>

#include <stdio.h>
#include <stdlib.h>
#define HAVE_REMOTE
#include <pcap.h>
#include "pheader.h"


using namespace std;

class SystemAPi : public QObject
{
    Q_OBJECT
public:
    explicit SystemAPi(QObject *parent = nullptr);
    ~SystemAPi();

    void startVidyo();

signals:
    void vidyoLoinSuccess();

public slots:

private:
    int detectVidyoLogin();//检测vidyo启动


    bool m_vidyoDetectRun;
};

#endif // SYSTEMAPI_H

#include "systemapi.h"
#include <QtConcurrent>
#include <QDebug>
#include "../../third_party/easyloggingpp/src/easylogging++.h"
SystemAPi::SystemAPi(QObject *parent) : QObject(parent)
  ,m_vidyoDetectRun(false)
{

}

SystemAPi::~SystemAPi()
{
    m_vidyoDetectRun=false;
}

void SystemAPi::startVidyo()
{
   QtConcurrent::run(this,&SystemAPi::detectVidyoLogin); //多线程运行
}

int SystemAPi::detectVidyoLogin()
{   
    QString curNetName;

    PIP_ADAPTER_INFO pAdapterInfo=NULL;
    PIP_ADAPTER_INFO pAdapter=NULL;
    DWORD dwRetVal=0;
    pAdapterInfo=(IP_ADAPTER_INFO*)malloc(sizeof(IP_ADAPTER_INFO));
    ULONG ulOutBufLen=sizeof(IP_ADAPTER_INFO);
    if(GetAdaptersInfo(pAdapterInfo,&ulOutBufLen)!=ERROR_SUCCESS)
    {
        GlobalFree(pAdapterInfo);
        pAdapterInfo=(IP_ADAPTER_INFO*)malloc(ulOutBufLen);
    }
    if((dwRetVal=GetAdaptersInfo(pAdapterInfo,&ulOutBufLen))==NO_ERROR)
    {
        pAdapter=pAdapterInfo;
        while(pAdapter)
        {
            if(strstr(pAdapter->Description,"PCI")>0 && pAdapter->Type==MIB_IF_TYPE_ETHERNET)
            {
                printf("______________________________________\n");
                printf("Name:%s\n",pAdapter->AdapterName);
                printf("Desc:%s\n",pAdapter->Description);

                curNetName = QString::fromStdString(pAdapter->AdapterName);
                for(UINT i=0;i<pAdapter->AddressLength;i++)
                {
                    printf("%02X%c",pAdapter->Address[i],i==pAdapter->AddressLength-1?'\n':'-');
                }
                printf("Type:%d\n",pAdapter->Type);
                printf("Address:%s\n",pAdapter->IpAddressList.IpAddress.String);
                printf("Mask:%s\n",pAdapter->IpAddressList.IpMask.String);
                printf("Gateway:%s\n",pAdapter->GatewayList.IpAddress.String);
            }
            pAdapter=pAdapter->Next;
        }
    }
    else
        printf("Call to GetAdaptersInfo failed!\n");
    
m_vidyoDetectRun=true;
    pcap_if_t* alldevs; // list of all devices
    pcap_if_t* d; // device you chose

    pcap_t* adhandle;

    char errbuf[PCAP_ERRBUF_SIZE]; //error buffer
    int i=0;
    int inum;

    struct pcap_pkthdr *pheader; /* packet header */
    const u_char * pkt_data; /* packet data */
    int res;

    /* pcap_findalldevs_ex got something wrong */
    if (pcap_findalldevs_ex(const_cast<char*>(PCAP_SRC_IF_STRING), NULL /* auth is not needed*/, &alldevs, errbuf) == -1)
    {
        fprintf(stderr, "Error in pcap_findalldevs_ex: %s\n", errbuf);
        exit(1);
    }

    /* print the list of all devices */
    for(d = alldevs; d != NULL; d = d->next)
    {
        printf("%d. %s", ++i, d->name); // print device name , which starts with "rpcap://"
        if(d->description){
            printf(" (%s)\n", d->description); // print device description

             LOG(INFO)<<"new device name"<<d->name<<"    "<<curNetName.toStdString();
            if(!QString(d->name).contains(curNetName,Qt::CaseInsensitive))//在a中查找b，如果不存在，
                printf("................not found\n");
            else{//否则存在。
                inum=i;
                printf("................found\n");

            }
        }
        else
            printf(" (No description available)\n");
    }

    /* no interface found */
    if (i == 0)
    {
        printf("\nNo interface found! Make sure Winpcap is installed.\n");
        return -1;
    }


    //printf("Enter the interface number (1-%d):", i);
    //scanf("%d", &inum);

    if(inum < 1 || inum > i)
    {
        printf("\nInterface number out of range.\n");
        pcap_freealldevs(alldevs);
        return -1;
    }

    for(d=alldevs, i=0; i < inum-1; d=d->next, i++); /* jump to the selected interface */

    /* open the selected interface*/
    if((adhandle = pcap_open(d->name, /* the interface name */
                             65536, /* length of packet that has to be retained */
                             PCAP_OPENFLAG_PROMISCUOUS, /* promiscuous mode */
                             1000, /* read time out */
                             NULL, /* auth */
                             errbuf /* error buffer */
                             )) == NULL)
    {
        fprintf(stderr, "\nUnable to open the adapter. %s is not supported by Winpcap\n",
                d->description);
        return -1;
    }

    printf("\nListening on %s...\n", d->description);

    pcap_freealldevs(alldevs); // release device list

    /* capture packet */
    while((res = pcap_next_ex(adhandle, &pheader, &pkt_data)) >= 0) {

        if(!m_vidyoDetectRun)
            return -1;
        if(res == 0)
            continue; /* read time out*/

        ether_header * eheader = (ether_header*)pkt_data; /* transform packet data to ethernet header */
        if(eheader->ether_type == htons(ETHERTYPE_IP)) { /* ip packet only */
            ip_header * ih = (ip_header*)(pkt_data+14); /* get ip header */

            if(ih->proto == htons(TCP_PROTOCAL)) { /* tcp packet only */
                int ip_len = ntohs(ih->tlen); /* get ip length, it contains header and body */

                int find_http = false;
                char* ip_pkt_data = (char*)ih;
                int n = 0;
                char buffer[BUFFER_MAX_LENGTH];
                int bufsize = 0;

                for(; n<ip_len; n++)
                {
                    /* http get or post request */
                    if(!find_http && ((n+3<ip_len && strncmp(ip_pkt_data+n,"GET",strlen("GET")) ==0 )
                                      || (n+4<ip_len && strncmp(ip_pkt_data+n,"POST",strlen("POST")) == 0)) )
                        find_http = true;

                    /* http response */
                    if(!find_http && n+8<ip_len && strncmp(ip_pkt_data+n,"HTTP/1.1",strlen("HTTP/1.1"))==0)
                        find_http = true;

                    /* if http is found */
                    if(find_http)
                    {
                        buffer[bufsize] = ip_pkt_data[n]; /* copy http data to buffer */
                        bufsize ++;
                    }
                }
                /* print http content */
                if(find_http) {
                    buffer[bufsize] = '\0';
                    //printf("%s\n", buffer);
                    qDebug()<<"http content"<<QString(buffer);
                    if(strstr(buffer,"SearchMyContactsResponse")!=NULL&&strstr(buffer,"faultcode")==NULL){
                        qDebug()<<"vidyo login success................."<<QString(buffer);
                        printf("%s\n", buffer);
                        emit vidyoLoinSuccess();
                        m_vidyoDetectRun=false;
                    }else{

                    }
                }
            }
        }
    }
    return 0;
}

#ifndef PHEADER_H_INCLUDED
#define PHEADER_H_INCLUDED
/*
*
*/

#define ETHER_ADDR_LEN 6 /* ethernet address */
#define ETHERTYPE_IP 0x0800 /* ip protocol */
#define TCP_PROTOCAL 0x0600 /* tcp protocol */
#define BUFFER_MAX_LENGTH 65536 /* buffer max length */
#define true 1  /* define true */
#define false 0 /* define false */

/*
* define struct of ethernet header , ip address , ip header and tcp header
*/
/* ethernet header */
typedef struct ether_header {
    u_char ether_shost[ETHER_ADDR_LEN]; /* source ethernet address, 8 bytes */
    u_char ether_dhost[ETHER_ADDR_LEN]; /* destination ethernet addresss, 8 bytes */
    u_short ether_type;                 /* ethernet type, 16 bytes */
}ether_header;

/* four bytes ip address */
typedef struct ip_address {
    u_char byte1;
    u_char byte2;
    u_char byte3;
    u_char byte4;
}ip_address;

/* ipv4 header */
typedef struct ip_header {
    u_char ver_ihl;         /* version and ip header length */
    u_char tos;             /* type of service */
    u_short tlen;           /* total length */
    u_short identification; /* identification */
    u_short flags_fo;       // flags and fragment offset
    u_char ttl;             /* time to live */
    u_char proto;           /* protocol */
    u_short crc;            /* header checksum */
    ip_address saddr;       /* source address */
    ip_address daddr;       /* destination address */
    u_int op_pad;           /* option and padding */
}ip_header;

/* tcp header */
typedef struct tcp_header {
    u_short th_sport;         /* source port */
    u_short th_dport;         /* destination port */
    u_int th_seq;             /* sequence number */
    u_int th_ack;             /* acknowledgement number */
    u_short th_len_resv_code; /* datagram length and reserved code */
    u_short th_window;        /* window */
    u_short th_sum;           /* checksum */
    u_short th_urp;           /* urgent pointer */
}tcp_header;

#endif // PHEADER_H_INCLUDED

3，效果

参考：https://www.cnblogs.com/blacksword/archive/2012/03/22/2411624.html