免费数据包截获技术的研究与实现

);
if (strFromIpFilter)
  if (strcmp(strFromIpFilter,szSourceIP)) return true;
//目的地址
saDest.sin_addr.s_addr = pIpheader->destIP;
strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);
if (strDestIpFilter)
  if (strcmp(strDestIpFilter,szDestIP)) return true;
iTTL = pIpheader->ttl;
//计算IP首部的长度
  int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);
//根据协议类型分别调用相应的函数
  switch(iProtocol)
  {
  case IPPROTO_TCP :DecodeTcpPack(buf+iIphLen, iBufSize);break;
  case IPPROTO_UDP :DecodeUdpPack(buf+iIphLen, iBufSize);break;
  case IPPROTO_ICMP :DecodeIcmpPack(buf+iIphLen, iBufSize);break;
default    :break;
  }
TCP解包函数
int DecodeTcpPack(char * TcpBuf, int iBufSize)
{
TCP_HEADER * pTcpHeader;
int i;
int iSourcePort,iDestPort;
pTcpHeader = (TCP_HEADER * )TcpBuf;
…
//如果过滤敏感字符串则判断是否包含
if (strSensitive)
  if ((strstr(TcpData, strSensitive))==NULL) return true;
//对端口进行过滤
iSourcePort = ntohs(pTcpHeader->th_sport);
iDestPort = ntohs(pTcpHeader->th_dport);
if ((iPortFilter) && (iSourcePort!=iPortFilter) && (iDestPort!=iPortFilter))
  return true;
//输出
printf("%s ", szProtocol);
printf("%15s:%5d ->%15s:%5d ", szSourceIP, iSourcePort, szDestIP, iDestPort);
printf("TTL=%3d ", iTTL);
…
//对于长度大于40字节的包进行数据分析(IP_HEADER+TCP_HEADER=40)
if ((ParamDecode) && (iBufSize>40))
{
  //分析TCP数据段
  if ((!strSensitive) || (strstr(TcpData,strSensitive)))
  {
   printf(" [DATA]\n");
   printf("%s",TcpData);
   printf("\n [DATA END]\n\n\n");
  }
}
return true;
}

UDP解包函数
int DecodeUdpPack(char * UdpBuf, int iBufSize)
{
UDP_HEADER *pUdpHeader;
pUdpHeader = (UDP_HEADER * )UdpBuf;
int iSourcePort = ntohs(pUdpHeader->uh_sport);
int iDestPort = ntohs(pUdpHeader->uh_dport);
//对端口进行过滤
if(iPortFilter)
  if ((iSourcePort!=iPortFilter) && (iDestPort!=iPortFilter))
   return true;
printf("%s ", szProtocol);
printf("%15s:%5d ->%15s:%5d ", szSourceIP, iSourcePort, szDestIP, iDestPort);
printf("TTL=%3d ", iTTL);
printf("Len=%4d ", ntohs(pUdpHeader->uh_len));
printf("bytes=%4d", iBufSize);
printf("\n");
//对于长度大于28字节的包进行数据分析
(IP_HEADER+UDP_HEADER>28)
  if ((ParamDecode) && (iBufSize>28))
  {
   printf(" [DATA]\n");
   //UDP首部长度为8
   char * UdpData=UdpBuf+8;
   //分析UDP数据段
   for(unsigned int i=0;i<(iBufSize-sizeof(UDP_HEADER));i++)
   {
    if (!(i%8)) printf("\n");
    if ( (Ud

首页上一页 4 5 6 7 8 9 下一页尾页 7/9/9

免费数据包截获技术的研究与实现(七)