基于RawSocket的數(shù)據(jù)包過濾程序.doc

基于RawSocket的數(shù)據(jù)包過濾程序，共包含7個(gè)文件：inetheader.h、rawsocsniffer.h、rawsocket.h、rawsocket.c、rawsocsniffer.c、main.c、makefile。編譯：命令行模式下，切換到代碼所在目錄，輸入make即可編譯。編譯后將生成一個(gè)可執(zhí)行文件main，以及一些obj文件。運(yùn)行：命令行下輸入 ./main -s 源IP -d 目的IP -atui 即可運(yùn)行程序，可以通過設(shè)置不同的參數(shù)可以實(shí)現(xiàn)簡單的過濾功能。參數(shù)功能如下： s是根據(jù)源IP地址過濾數(shù)據(jù)包 d是根據(jù)目的IP地址過濾數(shù)據(jù)包 a是過濾ARP包 t是過濾TCP包 u是過濾UDP包 i是過濾ICMP包代碼如下:#include #include #include #include rawsocsniffer.h#include inetheader.husing namespace std;rawsocsniffer:rawsocsniffer(int protocol):rawsocket(protocol),max_packet_len(2048) packet=new charmax_packet_len; memset(&simfilter,0,sizeof(simfilter);rawsocsniffer:rawsocsniffer() delete packet;/set the socket to promiscuous mode which means to capture all packets.bool rawsocsniffer:init() dopromisc(eth0);/set the filtervoid rawsocsniffer:setfilter(filter myfilter) tocol=tocol; simfilter.sip=myfilter.sip; simfilter.dip=myfilter.dip;bool rawsocsniffer:testbit(const unsigned int p,int k) if(p(k-1)&0x01)return true; elsereturn false;void rawsocsniffer:setbit(unsigned int &p,int k) p=(p)|(0x01)0) analyze(); else continue; /analyze packets;void rawsocsniffer:analyze() ether_header_t *etherpacket=(ether_header_t *)packet; if(tocol=0)tocol=0xff; switch (ntohs(etherpacket-frametype) case 0x0800: if(tocol)1) coutnn/*-ip packet-*/endl; ParseIPPacket(); break;case 0x0806: if(testbit(tocol,1) coutnn/*-arp packet-*/endl; ParseARPPacket(); break;case 0x0835: if(testbit(tocol,5) coutnn/*-RARP packet-*/endl;ParseRARPPacket(); break;default: coutnn/*-Unknown packet-*/endl; coutUnknown ethernet frametype!endl; break; /analyze ip packetsvoid rawsocsniffer:ParseIPPacket() ip_packet_t *ippacket=(ip_packet_t *)packet; tocol: tocol)ipheader.src_ip) return; if(simfilter.dip!=0) if(simfilter.dip!=(ippacket-ipheader.des_ip) return; switch (int(tocol) case 1: if(testbit(tocol,4) coutReceived an ICMP packetendl; ParseICMPPacket(); break;case 6: if(testbit(tocol,2) coutReceived an TCP packetendl; ParseTCPPacket(); break;case 17: if(testbit(tocol,3) coutReceived an UDP packetendl; ParseUDPPacket(); break;default: coutUnknown ip protocoltypearpheader.send_hw_addr); print_hw_addr(arppacket-arpheader.des_hw_addr); coutarpheader.send_prot_addr); print_ip_addr(arppacket-arpheader.des_prot_addr); coutendl; coutsetw(15)Hardware type: 0xhexarpheader.hw_type); coutsetw(15) Protocol type: 0t_type); coutsetw(15) Operation code: 0xhexarpheader.flag); coutendl;/analyze udp packets;void rawsocsniffer:ParseUDPPacket() udp_packet_t *udppacket=(udp_packet_t *)packet; coutsetw(20)etherheader.src_hw_addr); coutetherheader.des_hw_addr); coutendlsetw(20)ipheader.src_ip); coutipheader.des_ip); coutendl; coutsetw(10)srcport: udpheader.src_port) desport: udpheader.des_port) length:udpheader.len)endl;/analyze tcp packets;void rawsocsniffer:ParseTCPPacket() tcp_packet_t *tcppacket=(tcp_packet_t *)packet; coutsetw(20)etherheader.src_hw_addr); coutetherheader.des_hw_addr); coutendlsetw(20)ipheader.src_ip); coutipheader.des_ip); coutendl; coutsetw(10)srcport: tcpheader.src_port) desport: tcpheader.des_port)endl; coutseq: tcpheader.seq) ack: tcpheader.ack)endl;/analyze icmp packets;void rawsocsniffer:ParseICMPPacket() icmp_packet_t *icmppacket=(icmp_packet_t *)packet; coutsetw(20)etherheader.src_hw_addr); coutetherheader.des_hw_addr); coutendlsetw(20)ipheader.src_ip); coutipheader.des_ip); coutendl; coutsetw(12)icmp type: icmpheader.type) icmp code: icmpheader.code)endl; coutsetw(12)icmp id: icmpheader.id) icmp seq: icmpheader.seq)endl;void rawsocsniffer:print_hw_addr(const unsigned char *ptr) char hw_addr18; sprintf(hw_addr,%02x:%02x:%02x:%02x:%02x