注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

BCB-DG's Blog

...

 
 
 

日志

 
 

解析ARP数据包  

2009-09-28 09:11:03|  分类: winpcap |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
#pragma comment(lib,"Ws2_32.lib");
#pragma comment(lib, "wpcap.lib");

#include "pcap.h"
#include <fstream.h>
#include <iomanip.h>
#include <conio.h>
#include  "remote-ext.h "

struct arppkt{
 unsigned short hdtyp;//硬件类型,值0001表示其为Ethernet
 unsigned short protyp;//协议类型,值0800表示上层协议为IP
 unsigned char hdsize;//硬件地址长度,值为06
 unsigned char prosize;//协议地址长度,值为04
 unsigned short op;//操作值:0001/0002分别表示arp请求/应答
 u_char smac[6];//源mac地址6B
 u_char sip[4];//源IP地真址
 u_char dmac[6];//目标mac地址
 u_char dip[4];// 目标IP

};
void packet_handler(const pcap_pkthdr *header,const u_char *pkt_data,ostream &out);
void main(int argc,char *argv[])
{
/* if(argc!=2)
 {
  cout<<"Usage:arpparse logfilename"<<endl;
  cout<<"Press any key to continue."<<endl;
  _getch();
  return ;
 }*/
 pcap_if_t *alldevs;
 pcap_if_t *d;
 pcap_t *adhandle;
 char errbuf[PCAP_ERRBUF_SIZE];
 u_int netmask;
 char packet_filter[]="ether proto \\arp";
 struct bpf_program fcode;
 struct pcap_pkthdr *header;
  u_char *pkt_data;
 if(pcap_findalldevs(&alldevs,errbuf)==-1)
 {
  cout<<"Error in pcap_findalldevs"<<errbuf;
  return;
 }
 for(d=alldevs;d;d=d->next)
 {
  if((adhandle=pcap_open_live(d->name,1000,1,300,errbuf))==NULL)
  {
   cout<<"\nUnable to open the adapter.";
   pcap_freealldevs(alldevs);
   return;
  }
  if(pcap_datalink(adhandle)==DLT_EN10MB&&d->addresses!=NULL)
   break;
 }
 if(d==NULL)
 {
  cout<<"\nNo interfaces found! Make sure winpcap is intalled.\n";
  return ;
 }
 //
 netmask=((sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
 if(pcap_compile(adhandle,&fcode,packet_filter,1,netmask)<0)
 {
  cout<<"\nUnable to complie the packet filter .check the syntax.\n";
  pcap_freealldevs(alldevs);
  return;
 }
 if(pcap_setfilter(adhandle,&fcode)<0)
 {
  cout<<"\nError setting the filter.\n";
  pcap_freealldevs(alldevs);
  return;
 }
 cout<<"\t\tlistening on"<<d->description<<"..."<<endl<<endl;

 ofstream fout(argv[1],ios::app);
 time_t t;
 time(&t);
 fout.seekp(0,ios::end);
 if(fout.tellp()!=0)
  fout<<endl;
 fout<<"\t\tARP request(1)/reply(2) on"<<time(&t);
 cout<<"Sour IP Addr"<<"  "<<"Sour MAC Address"<<"  "
  <<"Des IP Addr"<<"  "<<"Des MAC Address"<<"  "
  <<"OP"<<"  "<<"Time"<<endl;
  fout<<"Sour IP Addr"<<"  "<<"Sour MAC Address"<<"  "
  <<"Des IP Addr"<<"  "<<"Des MAC Address"<<"  "
  <<"OP"<<"  "<<"Time"<<endl;
  pcap_freealldevs(alldevs);
  int result;
  while((result=pcap_next_ex(adhandle,&header,&pkt_data))>=0)
  {
   if(result==0)
    continue;
   packet_handler(header,pkt_data,cout);
   packet_handler(header,pkt_data,fout);
  }
  

void packet_handler(const pcap_pkthdr *header,const u_char *pkt_data,ostream &out)
{
 arppkt *arph=(arppkt *)(pkt_data+14);
 for(int i=0;i<3;i++)
  out<<int(arph->sip[i])<<'.';
 out.setf(ios::left);
 out<<setw(3)<<int(arph->sip[3])<<" ";
 out.unsetf(ios::left);

 char oldfillchar=out.fill('0');
 out.setf(ios::uppercase);
 for(i=0;i<5;i++)
  out<<hex<<setw(2)<<int(arph->smac[i])<<'-';
 cout<<hex<<setw(2)<<int(arph->smac[5])<<" ";
 out.fill(oldfillchar);

 out.unsetf(ios::hex|ios::uppercase);
 for(i=0;i<3;i++)
  out<<int(arph->dip[i])<<'-';
 out.setf(ios::left);
 out<<setw(3)<<int(arph->dip[3])<<" ";
 out.unsetf(ios::left);

 out.fill('0');
 out.setf(ios::uppercase);
 for(i=0;i<5;i++)
  out<<hex<<setw(2)<<int(arph->dmac[i])<<'-';
 out<<hex<<setw(2)<<int(arph->dmac[5])<<" ";
 out.fill(oldfillchar);
 out.unsetf(ios::hex|ios::uppercase);
 out<<ntohs(arph->op)<<" ";
 struct tm *ltime;
 ltime=localtime(&header->ts.tv_sec);
 out.fill('0');
 out<<ltime->tm_hour<<":"<<setw(2)<<ltime->tm_min<<':'<<setw(2)<<ltime->tm_sec;
 out.fill(oldfillchar);
 out<<endl;
}

  评论这张
 
阅读(1347)| 评论(0)
推荐 转载

历史上的今天

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2017