使用sharppcap抓数据包

使用sharppcap抓数据包

首先用到PacketDotNet,SharpPcap这两个DLL,工具Ethereal可以分析包内容

class Program

{

staticbool showDetails = false; //查看详情的参数

privatestaticbool BackgroundThreadStop = false; //线程停止标识privatestaticobject QueueLock = newobject(); //线程锁变量

privatestatic ListPacketQueue = new

List(); //待处理数据包队列

staticvoid Main(string[] args)

{

//显示SharpPcap版本

string ver = SharpPcap.Version.VersionString;

Console.WriteLine("SharpPcap {0}", ver);

//获取网络设备

var devices = LivePcapDeviceList.Instance;

if (devices.Count<1)

{

Console.WriteLine("找不到网络设备");

return;

}

Console.WriteLine();

Console.WriteLine("以下是目前本计算机上的活动网络设备:");

Console.WriteLine("----------------------------------------------------");

Console.WriteLine();

int i = 0;

foreach (LivePcapDevicedev in devices)

{

Console.WriteLine("{0}) {1} {2}", i, https://www.360docs.net/doc/7f671855.html,, dev.Description);

i++;

}

//选择要监听的网络设备

Console.WriteLine();

Console.WriteLine("--选择一个需要监听的网络设备--");

i = int.Parse(Console.ReadLine());

LivePcapDevice device = devices[i];

Console.Write("-- 请选择操作：监听通讯[C/c]，多线程监听通讯[T/t]，监听

统计[F/f]，发送随机数据包[S/s]? ");

string resp = Console.ReadLine().ToUpper();

while (!(resp.StartsWith("C") || resp.StartsWith("F") ||

resp.StartsWith("T") || resp.StartsWith("S")))

{

resp = Console.ReadLine().ToUpper();

}

try

{

if (resp.StartsWith("C") || resp.StartsWith("F") ||

resp.StartsWith("T"))

{

//监听过滤条件

string filter = "ip and tcp";

//连接设备

System.Threading.ThreadbackgroundThread = null;

int readTimeoutMilliseconds = 1000;

if (resp.StartsWith("F"))

{

device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds); device.Filter=filter;

device.Mode = CaptureMode.Statistics; //抓包统计

device.OnPacketArrival+=

new PacketArrivalEventHandler(device_OnPacketArrival); //抓数据包回调事件

device.OnPcapStatistics +=

new StatisticsModeEventHandler(device_OnPcapStatistics); //抓包统计回调事件

}

elseif (resp.StartsWith("C"))

{

device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds); device.Filter = filter;

device.Mode = CaptureMode.Packets; //抓包数据

showDetails = resp.EndsWith("-A"); //当抓数据包时，检查是否要查看详情

device.OnPacketArrival +=

new PacketArrivalEventHandler(device_OnPacketArrival); //抓数据包回调事件

}

elseif (resp.StartsWith("T"))

{

backgroundThread = new System.Threading.Thread(BackgroundThread); backgroundThread.Start();

device.Open();

device.Filter = filter;

device.Mode = CaptureMode.Packets; //抓数据包

showDetails = resp.EndsWith("-A"); //当抓数据包时，检查是否要查看详情device.OnPacketArrival +=

new PacketArrivalEventHandler(device_OnThreadPacketArrival); //抓数据包回调事件

}

Console.WriteLine();

Console.WriteLine("-- 当前TCPdump过滤条件: \"{0}\"", filter); Console.WriteLine("-- 正在监听设备 {0}, 按 '回车' 键以停止监听...", device.Description);

//开始监听

device.StartCapture();

//停止监听

Console.ReadLine();

device.StopCapture();

Console.WriteLine("-- 停止监听.");

if (backgroundThread != null)

{

BackgroundThreadStop = true;

backgroundThread.Join();

}

}

elseif (resp.StartsWith("S"))

{

//连接设备

device.Open();

//生成随机数据包

byte[] bytes = GetRandomPacket();

try

{

//发送数据

device.SendPacket(bytes);

SendQueuesqueue = new SendQueue(2000);

Console.WriteLine("-- 单个数据包发送成功.");

for (int j = 0; j <10; j++)

{

if (!squeue.Add(bytes))

{

Console.WriteLine("-- 警告: 队列大小不足以存放所有数据包，将只发送部分数据包.");

break;

}

}

device.SendQueue(squeue, SendQueueTransmitModes.Synchronized); Console.WriteLine("-- 数据包队列发送完毕.");

}

catch (Exception e)

{

Console.WriteLine("-- -- -- " + e.Message);

}

}

}

catch (Exception e)

{

Console.WriteLine("-- -- -- " + e.Message);

}

finally

{

if (device.Opened)

{

//断开设备连接

Console.WriteLine(device.Statistics().ToString());

device.Close();

Console.WriteLine("--断开设备连接");

Console.Write("按 '回车' 键以退出...");

Console.Read();

}

}

Console.Read();

}

///

///抓包方法

///

staticvoid device_OnPacketArrival(object sender, CaptureEventArgs e)

{

PcapPorcessContext(e.Packet);

}

privatestaticvoid PcapPorcessContext(PacketDotNet.RawPacketpPacket) {

var time = pPacket.Timeval.Date;

varlen = pPacket.Data.Length;

var layer = pPacket.LinkLayerType;

Console.WriteLine("{0}:{1}:{2},{3} 长度={4} 第几层={5}",

time.Hour, time.Minute, time.Second, https://www.360docs.net/doc/7f671855.html,lisecond, len, layer);

Console.WriteLine("content is {0}",

Encoding.ASCII.GetString(pPacket.Data));

var packet = PacketDotNet.Packet.ParsePacket(pPacket); //Raw基础包对象

if (layer == PacketDotNet.LinkLayers.Ethernet) //以太网包

{

varethernetPacket = (PacketDotNet.EthernetPacket)packet;

https://www.360docs.net/doc/7f671855.html,workInformation.PhysicalAddresssrcMac = ethernetPacket.SourceHwAddress;

https://www.360docs.net/doc/7f671855.html,workInformation.PhysicalAddressdestMac = ethernetPacket.DestinationHwAddress;

Console.WriteLine("MAC:{0} -> {1}", srcMac, destMac);

if (showDetails)

Console.WriteLine("以太网包: " +

ethernetPacket.ToColoredString(false));

}

varipPacket = PacketDotNet.IpPacket.GetEncapsulated(packet); //ip包if (ipPacket != null)

{

https://www.360docs.net/doc/7f671855.html,.IPAddresssrcIp = ipPacket.SourceAddress;

https://www.360docs.net/doc/7f671855.html,.IPAddressdestIp = ipPacket.DestinationAddress;

Console.WriteLine("IP: {0} -> {1}", srcIp, destIp);

if (showDetails) Console.WriteLine("IP packet: " +

ipPacket.ToColoredString(false));

vartcpPacket = PacketDotNet.TcpPacket.GetEncapsulated(packet); //TCP 包

if (tcpPacket != null)

{

int srcPort = tcpPacket.SourcePort;

int destPort = tcpPacket.DestinationPort;

Console.WriteLine("TCP Port: {0} -> {1}", srcPort, destPort);

if (showDetails) Console.WriteLine("TCP packet: " +

tcpPacket.ToColoredString(false));

}

varudpPacket = PacketDotNet.UdpPacket.GetEncapsulated(packet); //UDP 包

if (udpPacket != null)

{

int srcPort = udpPacket.SourcePort;

int destPort = udpPacket.DestinationPort;

Console.WriteLine("UDP Port: {0} -> {1}", srcPort, destPort);

if (showDetails) Console.WriteLine("UDP packet: " +

udpPacket.ToColoredString(false));

}

}

}

staticulong oldSec = 0;

staticulong oldUsec = 0;

///

///抓包统计方法

///

staticvoid device_OnPcapStatistics(object sender, StatisticsModeEventArgs e)

{

// 计算统计心跳间隔

ulong delay = (e.Statistics.Timeval.Seconds - oldSec) * 1000000- oldUsec + e.Statistics.Timeval.MicroSeconds;

// 获取 Bits per second

ulong bps = ((ulong)e.Statistics.RecievedBytes * 8 * 1000000) / delay; /* ^ ^

| |

| |

| |

converts bytes in bits -- |

|

delay is expressed in microseconds --

*/

// 获取 Packets per second

ulong pps = ((ulong)e.Statistics.RecievedPackets * 1000000) / delay;

// 将时间戳装换为易读格式

varts = e.Statistics.Timeval.Date.ToLongTimeString();

// 输出统计结果

Console.WriteLine("{0}: bps={1}, pps={2}", ts, bps, pps);

//记录本次统计时间戳，以用于下次统计计算心跳间隔

oldSec = e.Statistics.Timeval.Seconds;

oldUsec = e.Statistics.Timeval.MicroSeconds;

}

///

///

///

privatestatic DateTimeLastStatisticsOutput = DateTime.Now;

privatestatic TimeSpanLastStatisticsInterval = new TimeSpan(0, 0, 2); staticvoid device_OnThreadPacketArrival(object sender, CaptureEventArgs e)

{

//输出设备通讯统计信息

var Now = DateTime.Now;

var interval = Now - LastStatisticsOutput;

if (interval >LastStatisticsInterval)

{

Console.WriteLine("Device Statistics: " +

((LivePcapDevice)e.Device).Statistics());

LastStatisticsOutput = Now;

}

lock (QueueLock)

{

PacketQueue.Add(e.Packet); //将捕获到的数据包加入处理队列

}

}

///

///多线程处理数据包队列

///

privatestaticvoid BackgroundThread()

{

while (!BackgroundThreadStop)

{

bool shouldSleep = true;

lock (QueueLock)

{

if (PacketQueue.Count != 0)

{

shouldSleep = false;

}

}

if (shouldSleep)

{

System.Threading.Thread.Sleep(250);

}

else//处理队列

{

ListourQueue; //本线程待处理队列

lock (QueueLock)

{

ourQueue = PacketQueue;

PacketQueue = new List();

}

Console.WriteLine("BackgroundThread: Local Queue Count is {0}", ourQueue.Count);

foreach (var packet in ourQueue)

{

PcapPorcessContext(packet);

}

}

}

}

///

///生成一个大小为200的随机数据包

///

privatestaticbyte[] GetRandomPacket()

{

byte[] packet = newbyte[200];

Random rand = new Random(); rand.NextBytes(packet);

return packet;

}

}