Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

Analyze packets (Microsoft Visual Studio 2010)

2025-02-25 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >

Share

Shulou(Shulou.com)06/01 Report--

//Fenxi1.cpp: Defines the entry point for the console application.

//

The code is as follows:

#include "stdafx.h"

#include "pcap.h"

#include "bittypes.h"

#pragma comment(lib,"ws2_32.lib")

typedef struct ip_address{

u_char byte1;

u_char byte2;

u_char byte3;

u_char byte4;

}ip_address;

/* IPv4 header */

typedef struct ip_header{

u_char ver_ihl; //version (4 bits) + header length (4 bits)

u_char tos; //Type of service

u_short tlen; //Total length

u_short identification; //Identification

u_short flags_fo; //Flags (3 bits) + Fragment offset (13 bits)

u_char ttl; //Time to live

u_char proto; //protocol (Protocol)

u_short crc; //Header checksum

ip_address saddr; //Source address

ip_address daddr; //Destination address

u_int op_pad; //Option + Padding

}ip_header;

/* UDP header */

typedef struct udp_header{

u_short sport; //Source port

u_short dport; //Destination port

u_short len; // UDP Datagram length

u_short crc; //Checksum

}udp_header;

/* Callback function prototype */

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

int _tmain(int argc, _TCHAR* argv[])

{

pcap_if_t *alldevs;

pcap_if_t *d;

int inum;

int i=0;

pcap_t *adhandle;

char errbuf[PCAP_ERRBUF_SIZE];

u_int netmask;

char packet_filter[] = "ip and udp";

struct bpf_program fcode;

/* Get device list */

if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)

{

fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);

exit(1);

}

/* Print list */

for(d=alldevs; d; d=d->next)

{

printf("%d. %s", ++i, d->name);

if (d->description)

printf(" (%s)\n", d->description);

else

printf(" (No description available)\n");

}

if(i==0)

{

printf("\nNo interfaces found! Make sure WinPcap is installed.\ n");

return -1;

}

printf("Enter the interface number (1-%d):",i);

scanf("%d", &inum);

if(inum

< 1 || inum >

i)

{

printf("\nInterface number out of range.\ n");

/* Release Device List */

pcap_freealldevs(alldevs);

return -1;

}

/* Jump to selected device */

for(d=alldevs, i=0; i

< inum-1 ;d=d->

next, i++);

/* Open adapter */

if ( (adhandle= pcap_open(d->name, //device name

65536, //Part of packet to capture

// 65535 Guaranteed to capture the full contents of every packet on different data link layers

PCAP_OPENFLAG_PROMISCUOUS, //promiscuous mode

1000, //read timeout

NULL, //remote machine validation

errbuf //error buffer pool

) ) == NULL)

{

fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");

/* Release Device List */

pcap_freealldevs(alldevs);

return -1;

}

/* Check the data link layer, for simplicity we will only consider Ethernet */

if(pcap_datalink(adhandle) != DLT_EN10MB)

{

fprintf(stderr,"\nThis program works only on Ethernet networks.\ n");

/* Release Device List */

pcap_freealldevs(alldevs);

return -1;

}

if(d->addresses != NULL)

/* Get mask for first address of interface */

netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;

else

/* If the interface does not have an address, then we assume a mask of class C */

netmask=0xffffff;

//compile filter

if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) ts.tv_sec;

ltime=localtime(&local_tv_sec);

strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);

/* Print packet timestamp and length */

printf("%s.%. 6d len:%d ", timestr, header->ts.tv_usec, header->len);

/* Get IP packet header location */

ih = (ip_header *) (pkt_data +

14); //Ethernet header length

/* Get UDP header location */

ip_len = (ih->ver_ihl & 0xf) * 4;

uh = (udp_header *) ((u_char*)ih + ip_len);

/* Convert network byte sequence to host byte sequence */

sport = ntohs( uh->sport );

dport = ntohs( uh->dport );

/* Print IP address and UDP port */

printf("%d.% d.% d.% d.% d -> %d.% d.% d.% d.% d\n",

ih->saddr.byte1,

ih->saddr.byte2,

ih->saddr.byte3,

ih->saddr.byte4,

sport,

ih->daddr.byte1,

ih->daddr.byte2,

ih->daddr.byte3,

ih->daddr.byte4,

dport);

}

Item-->** Attributes (alt+F7)

Configuration Properties-->C/C++--> General--> Attach Include Directory-->(Add the file path (Include) where the header file is located to the Attach Directory C:\WpdPack\Include)

Item-->** Attributes (alt+F7)

Configuration Properties--> Linker--> General--> Add-on Library Directory-->(add Packet.lib;wpcap.lib directory (Lib) to Add-on Library Directory C:\WpdPack\Lib)

Item-->** Attributes (alt+F7)

Configuration Properties--> Linkers--> Input--> Additional Dependency--> Supplement ";Packet.lib;wpcap.lib"

Item-->** Attributes (alt+F7)

Configuration Properties-->C/C++-> Preprocessor--> Preprocessor Definition--> Supplement ";HAVE_REMOTE"

Add the head as follows

#include "pcap.h"

#include "bittypes.h"

#pragma comment(lib,"ws2_32.lib")

Below is the result chart obtained:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Network Security

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report