winpcap捕获数据包

//技术手册：http://www.ferrisxu.com/WinPcap/html/index.html

源代码：

#include "stdafx.h"
#include<iostream>
using namespace std;
#include <pcap.h>
using namespace std;
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <net.h>
#pragma comment(lib,"ws2_32.lib")
#define MAX_PRINT 80
#define MAX_LINE 16

#pragma once

typedef unsigned char u_int8_t;
typedef unsigned short int u_int16_t;
typedef unsigned int u_int32_t;
#define  ETH_ALEN 6

struct iphdr
{
#if __BYTE_ORDER == __LITTLE_ENDIAN
 unsigned int ihl:4;
 unsigned int version:4;
#elif __BYTE_ORDER == __BIG_ENDIAN
 unsigned int version:4;
 unsigned int ihl:4;
#else
# error "Please fix <bits/endian.h>"
#endif
 u_int8_t tos;
 u_int16_t tot_len;
 u_int16_t id;
 u_int16_t frag_off;
 u_int8_t ttl;
 u_int8_t protocol;
 u_int16_t check;
 u_int32_t saddr;
 u_int32_t daddr;
 /*The options start here. */
};

# ifdef __FAVOR_BSD
typedef u_int32_t tcp_seq;
/*
* TCP header.
* Per RFC 793, September, 1981.
*/
struct tcphdr
{
 u_int16_t th_sport;         /* source port */
 u_int16_t th_dport;         /* destination port */
 tcp_seq th_seq;             /* sequence number */
 tcp_seq th_ack;             /* acknowledgement number */
#  if __BYTE_ORDER == __LITTLE_ENDIAN
 u_int8_t th_x2:4;           /* (unused) */
 u_int8_t th_off:4;          /* data offset */
#  endif
#  if __BYTE_ORDER == __BIG_ENDIAN
 u_int8_t th_off:4;          /* data offset */
 u_int8_t th_x2:4;           /* (unused) */
#  endif
 u_int8_t th_flags;
#  define TH_FIN        0x01
#  define TH_SYN        0x02
#  define TH_RST        0x04
#  define TH_PUSH       0x08
#  define TH_ACK        0x10
#  define TH_URG        0x20
 u_int16_t th_win;           /* window */
 u_int16_t th_sum;           /* checksum */
 u_int16_t th_urp;           /* urgent pointer */
};

# else /* !__FAVOR_BSD */
struct tcphdr
{
 u_int16_t source;
 u_int16_t dest;
 u_int32_t seq;
 u_int32_t ack_seq;
#  if __BYTE_ORDER == __LITTLE_ENDIAN
 u_int16_t res1:4;
 u_int16_t doff:4;
 u_int16_t fin:1;
 u_int16_t syn:1;
 u_int16_t rst:1;
 u_int16_t psh:1;
 u_int16_t ack:1;
 u_int16_t urg:1;
 u_int16_t res2:2;
#  elif __BYTE_ORDER == __BIG_ENDIAN
 u_int16_t doff:4;
 u_int16_t res1:4;
 u_int16_t res2:2;
 u_int16_t urg:1;
 u_int16_t ack:1;
 u_int16_t psh:1;
 u_int16_t rst:1;
 u_int16_t syn:1;
 u_int16_t fin:1;
#  else
#   error "Adjust your <bits/endian.h> defines"
#  endif
 u_int16_t window;
 u_int16_t check;
 u_int16_t urg_ptr;
};
#endif

#define ETH_P_802_3     0x0001          /* Dummy type for 802.3 frames  */
#define ETH_P_AX25      0x0002          /* Dummy protocol id for AX.25  */
#define ETH_P_ALL       0x0003          /* Every packet (be careful!!!) */
#define ETH_P_802_2     0x0004          /* 802.2 frames                 */
#define ETH_P_SNAP      0x0005          /* Internal only                */
#define ETH_P_DDCMP     0x0006          /* DEC DDCMP: Internal only     */
#define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
#define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
#define ETH_P_LOCALTALK 0x0009          /* Localtalk pseudo type        */
#define ETH_P_CAN       0x000C          /* Controller Area Network      */
#define ETH_P_PPPTALK   0x0010          /* Dummy type for Atalk over PPP*/
#define ETH_P_TR_802_2  0x0011          /* 802.2 frames                 */
#define ETH_P_MOBITEX   0x0015          /* Mobitex ( kaz@cafe.net )       */
#define ETH_P_CONTROL   0x0016          /* Card specific control frames */
#define ETH_P_IRDA      0x0017          /* Linux-IrDA                   */
#define ETH_P_ECONET    0x0018          /* Acorn Econet                 */
#define ETH_P_HDLC      0x0019          /* HDLC frames                  */
#define ETH_P_ARCNET    0x001A          /* 1A for ArcNet :-)            */
struct ethhdr {
 unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
 unsigned char   h_source[ETH_ALEN];     /* source ether addr    */
 u_int16_t          h_proto;                /* packet type ID field */
} ;

/* 4字节的IP地址 */
typedef struct ip_address{
    u_char byte1;
    u_char byte2;
    u_char byte3;
    u_char byte4;
}ip_address;

/* IPv4 首部 */
typedef struct ip_header{
    u_char  ver_ihl;        // 版本 (4 bits) + 首部长度 (4 bits)
    u_char  tos;            // 服务类型(Type of service)
    u_short tlen;           // 总长(Total length)
    u_short identification; // 标识(Identification)
    u_short flags_fo;       // 标志位(Flags) (3 bits) + 段偏移量(Fragment offset) (13 bits)
    u_char  ttl;            // 存活时间(Time to live)
    u_char  proto;          // 协议(Protocol)
    u_short crc;            // 首部校验和(Header checksum)
    ip_address  saddr;      // 源地址(Source address)
    ip_address  daddr;      // 目的地址(Destination address)
    u_int   op_pad;         // 选项与填充(Option + Padding)
}ip_header;

/* UDP 首部*/
typedef struct udp_header{
    u_short sport;          // 源端口(Source port)
    u_short dport;          // 目的端口(Destination port)
    u_short len;            // UDP数据包长度(Datagram length)
    u_short crc;            // 校验和(Checksum)
}udp_header;

/* packet handler 函数原型 */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

int main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];
u_int netmask;
char packet_filter[] = "dst host 192.168.0.1";//过了条件port 20 and ip and tcp dst host 127.0.0.1
struct bpf_program fcode;

    
    /* 获取本机设备列表 */
    if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
    {
        fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
        exit(1);
    }
    
    /* 打印列表 */
    for(d=alldevs; d; d=d->next)
    {
        printf("%d. %s", ++i, d->name);
        if (d->description)
            printf(" (%s)\n", d->description);
        else
            printf(" (No description available)\n");
    }
    
    if(i==0)
    {
        printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
        return -1;
    }
    
    printf("Enter the interface number (1-%d):",i);
    scanf("%d", &inum);
    
    if(inum < 1 || inum > i)
    {
        printf("\nInterface number out of range.\n");
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }
    
    /* 跳转到选中的适配器 */
    for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
    
    /* 打开设备 */
    if ( (adhandle= pcap_open(d->name,          // 设备名
                              65536,            // 65535保证能捕获到不同数据链路层上的每个数据包的全部内容
                                 PCAP_OPENFLAG_NOCAPTURE_RPCAP,//PCAP_OPENFLAG_PROMISCUOUS,    // 混杂模式
                              1000,             // 读取超时时间
                              NULL,             // 远程机器验证
                              errbuf            // 错误缓冲池
                              ) ) == NULL)
    {
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }
    


      /* 检查数据链路层，为了简单，我们只考虑以太网 */
    if(pcap_datalink(adhandle) != DLT_EN10MB)
    {
        fprintf(stderr,"\nThis program works only on Ethernet networks.\n");
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }
    
    if(d->addresses != NULL)
        /* 获得接口第一个地址的掩码 */
        netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
    else
        /* 如果接口没有地址，那么我们假设一个C类的掩码 */
        netmask=0xffffff;


    //编译过滤器
    if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) <0 )
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }
    
    //设置过滤器
    if (pcap_setfilter(adhandle, &fcode)<0)
    {
        fprintf(stderr,"\nError setting the filter.\n");
        /* 释放设备列表 */
        pcap_freealldevs(alldevs);
        return -1;
    }
    




    printf("\nlistening on %s...\n", d->description);
    
    /* 释放设备列表 */
    pcap_freealldevs(alldevs);
    
    /* 开始捕获 */
    pcap_loop(adhandle, 0, packet_handler, NULL);
    
    return 0;
}


/* 每次捕获到数据包时，libpcap都会自动调用这个回调函数 */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    /*struct tm *ltime;
    char timestr[16];
    time_t local_tv_sec;
    
    // 将时间戳转换成可识别的格式
    local_tv_sec = header->ts.tv_sec;
    ltime=localtime(&local_tv_sec);
    strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
    
    printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);*/

    struct tm *ltime;
    struct iphdr *ip;
    struct ethhdr *eth;
    struct tcphdr *tcp;

    char timestr[16];
    ip_header *ih;
    udp_header *uh;
    u_int ip_len;
    u_short sport,dport;
    time_t local_tv_sec;
    
    
    pkt_data=(pkt_data + sizeof(struct ethhdr) + sizeof(struct iphdr)+sizeof(struct tcphdr))-4;//-4 表示移动32位
    
    const char* target="corporation/login_corporation.yizhi?method=verify";
    
    if(!(strstr((char*)pkt_data,target)))
    {
        return;
    }


    if()

        oa/corporation/login_corporation.yizhi?method=verify
    cout<<pkt_data<<endl;

    

}