18.3 NPCAP自定义数据包过滤

int pcap_compile(pcap_t *p, struct bpf_program *fp, const char *str, int optimize, bpf_u_int32 netmask);

int pcap_setfilter(pcap_t *p, struct bpf_program *fp);

int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user);

#include <iostream>
#include <winsock2.h>
#include <Windows.h>
#include <string>
#include <pcap.h>

#pragma comment(lib,"ws2_32.lib")
#pragma comment(lib, "packet.lib")
#pragma comment(lib, "wpcap.lib")

using namespace std;

// 打开网卡返回的指针
pcap_t* m_adhandle;

// 解码TCP数据包，需要先加14跳过数据链路层, 然后再加20跳过IP层。
void PrintTCPHeader(const unsigned char * packetData)
{
  typedef struct tcp_header
  {
    short SourPort;                 // 源端口号16bit
    short DestPort;                 // 目的端口号16bit
    unsigned int SequNum;           // 序列号32bit
    unsigned int AcknowledgeNum;    // 确认号32bit
    unsigned char reserved : 4, offset : 4; // 预留偏移

    unsigned char  flags;               // 标志 

    short WindowSize;               // 窗口大小16bit
    short CheckSum;                 // 检验和16bit
    short surgentPointer;           // 紧急数据偏移量16bit
  }tcp_header;

  struct tcp_header *tcp_protocol;
  // +14 跳过数据链路层 +20 跳过IP层
  tcp_protocol = (struct tcp_header *)(packetData + 14 + 20);

  u_short sport = ntohs(tcp_protocol->SourPort);
  u_short dport = ntohs(tcp_protocol->DestPort);
  int window = tcp_protocol->WindowSize;
  int flags = tcp_protocol->flags;

  printf("源端口: %6d --> 目标端口: %6d --> 窗口大小: %7d --> 标志: (%d)",
    sport, dport, window, flags);

  if (flags & 0x08) printf("PSH 数据传输\n");
  else if (flags & 0x10) printf("ACK 响应\n");
  else if (flags & 0x02) printf("SYN 建立连接\n");
  else if (flags & 0x20) printf("URG \n");
  else if (flags & 0x01) printf("FIN 关闭连接\n");
  else if (flags & 0x04) printf("RST 连接重置\n");
  else printf("None 未知\n");
}

// 解析过滤数据包（回调函数）
void packet_handler(u_char* param, const struct pcap_pkthdr* header, const u_char* pkt_data)
{
  // std::cout << pkt_data << std::endl;
  PrintTCPHeader(pkt_data);
}

// 获取网卡并设置过滤器
BOOL GetAndOpenAdapter(std::string local_address, std::string filter)
{
  pcap_if_t* alldevs = NULL, *d = NULL;
  char errbuf[256] = { 0 };
  bpf_program fcode;
  u_int netmask;

  // 获取网卡设备指针
  if (-1 == pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf))
  {
    return FALSE;
  }

  // 选取适合网卡
  int flag = 0;
  for (d = alldevs; d; d = d->next)
  {
    pcap_addr_t* p = d->addresses;
    while (p)
    {
      if (local_address == inet_ntoa(((sockaddr_in*)p->addr)->sin_addr))
      {
        flag = 1;
        break;
      }
      p = p->next;
    }
    if (1 == flag)
      break;
  }
  if (0 == flag)
  {
    // 请检查本机IP地址是否正确
    return FALSE;
  }

  // 获取子网掩码
  netmask = ((sockaddr_in*)d->addresses->netmask)->sin_addr.S_un.S_addr;

  // 打开网卡
  m_adhandle = pcap_open(d->name, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf);
  if (NULL == m_adhandle)
  {
    pcap_freealldevs(alldevs);
    return FALSE;
  }

  // 检查以太网
  if (DLT_EN10MB != pcap_datalink(m_adhandle))
  {
    pcap_freealldevs(alldevs);
    return FALSE;
  }

  // 编译过滤器
  char filter_ptr[4096] = { 0 };
  sprintf(filter_ptr, filter.c_str());

  if (0 > pcap_compile(m_adhandle, &fcode, filter_ptr, 1, netmask))
  {
    // 编译过滤器出错
    pcap_freealldevs(alldevs);
    return FALSE;
  }

  // 设置过滤器
  if (0 > pcap_setfilter(m_adhandle, &fcode))
  {
    // 设置过滤器出错
    pcap_freealldevs(alldevs);
    return FALSE;
  }

  // 释放网卡设备列表
  pcap_freealldevs(alldevs);

  // 开始捕捉数据包
  pcap_loop(m_adhandle, 0, packet_handler, NULL);
  return TRUE;
}

int main(int argc, char* argv[])
{
  BOOL flag = GetAndOpenAdapter("192.168.9.125", "dst host www.lyshark.com");

  system("pause");
  return 0;
}