读取pcap文件，过滤非tcp包，获取IP及tcp端口信息
1 // OpenAndFilterAndPres.cpp : Defines the entry point for the console application.
2 //
3
4 #include "stdafx.h"
5 #include "pcap.h"
6 #include "remote-ext.h"
7 #include"stdlib.h"
8
9 /* 4 bytes IP address */
10 typedef struct ip_address{
11 u_char byte1;
12 u_char byte2;
13 u_char byte3;
14 u_char byte4;
15 }ip_address;
16
17 /* IPv4 header */
18 typedef struct ip_header{
19 u_char ver_ihl; // Version (4 bits) + Internet header length (4 bits)
20 u_char tos; // Type of service
21 u_short tlen; // Total length
22 u_short identification; // Identification
23 u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)
24 u_char ttl; // Time to live
25 u_char proto; // Protocol
26 u_short crc; // Header checksum
27 ip_address saddr; // Source address
28 ip_address daddr; // Destination address
29 u_int op_pad; // Option + Padding
30 }ip_header;
31
32 /* UDP header*/
33 typedef struct udp_header{
34 u_short sport; // Source port
35 u_short dport; // Destination port
36 u_short len; // Datagram length
37 u_short crc; // Checksum
38 }udp_header;
39
40 // TCP首部
41 typedef struct tcp_header{
42 WORD source_port; // (16 bits) Winsock 内置函数 ntohs（），主要作用将大端转换为小端！
43 WORD destination_port; // (16 bits) Winsock 内置函数 ntohs（），主要作用将大端转换为小端！
44 DWORD seq_number; // Sequence Number (32 bits) 大小端原因，高低位4个8bit的存放顺序是反的，intel使用小端模式
45 DWORD ack_number; // Acknowledgment Number (32 bits) 大小端原因，高低位4个8bit的存放顺序是反的，intel使用小端模式
46 WORD info_ctrl; // Data Offset (4 bits), Reserved (6 bits), Control bits (6 bits) intel使用小端模式
47 WORD window; // (16 bits)
48 WORD checksum; // (16 bits)
49 WORD urgent_pointer; // (16 bits)
50 } tcp_header;
51
52 /* prototype of the packet handler */
53 void dispatcher_handler(u_char *temp1,
54 const struct pcap_pkthdr *header, const u_char *pkt_data);
55
56
57 int main(int argc, char* argv[])
58 {
59 pcap_t *fp;
60 char errbuf[PCAP_ERRBUF_SIZE];
61 char source[PCAP_BUF_SIZE];
62 //char packet_filter[] = "tcp";
63 //有tcp必有ip
64 char packet_filter[] = "ip and tcp";
65 struct bpf_program fcode;
66 u_int netmask;
67
68 if(argc != 2){
69 printf("usage: %s filename", argv[0]);
70 return -1;
71 }
72
73 /* Create the source string according to the new WinPcap syntax */
74 if ( pcap_createsrcstr( source, // variable that will keep the source string
75 PCAP_SRC_FILE, // we want to open a file
76 NULL, // remote host
77 NULL, // port on the remote host
78 argv[1], // name of the file we want to open
79 errbuf // error buffer
80 ) != 0)
81 {
82 fprintf(stderr,"\nError creating a source string\n");
83 return -1;
84 }
85
86 /* Open the capture file */
87 if ( (fp= pcap_open(source, // name of the device
88 65536, // portion of the packet to capture
89 // 65536 guarantees that the whole packet will be captured on all the link layers
90 PCAP_OPENFLAG_PROMISCUOUS, // promiscuous mode
91 1000, // read timeout
92 NULL, // authentication on the remote machine
93 errbuf // error buffer
94 ) ) == NULL)
95 {
96 fprintf(stderr,"\nUnable to open the file %s.\n", source);
97 return -1;
98 }
99
100 netmask=0xffffff;
101
102 //compile the filter
103 if (pcap_compile(fp, &fcode, packet_filter, 1, netmask) <0 )
104 {
105 fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
106 return -1;
107 }
108
109 //set the filter
110 if (pcap_setfilter(fp, &fcode)<0)
111 {
112 fprintf(stderr,"\nError setting the filter.\n");
113 return -1;
114 }
115
116 // read and dispatch packets until EOF is reached
117 pcap_loop(fp, 0, dispatcher_handler, NULL);
118
119 return 0;
120 }
121
122 void dispatcher_handler(u_char *temp1,
123 const struct pcap_pkthdr *header, const u_char *pkt_data)
124 {
125 struct tm *ltime;
126 char timestr[16];
127 ip_header *ih;
128 tcp_header *th;
129 u_int ip_len;
130 u_short sport,dport;
131 time_t local_tv_sec;
132
133 /* convert the timestamp to readable format */
134 local_tv_sec = header->ts.tv_sec;
135 ltime=localtime(&local_tv_sec);
136 strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
137
138 /* print timestamp and length of the packet */
139 printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len);
140
141 /* retireve the position of the ip header */
142 ih = (ip_header *) (pkt_data +
143 14); //length of ethernet header
144
145 /* retireve the position of the tcp header */
146 //从IPV4首部中取出"首部长度(4 bits)"
147 ip_len = (ih->ver_ihl & 0xf) * 4;
148 //强制类型转换，便于用自己的命名处理
149 th = (tcp_header *) ((u_char*)ih + ip_len);
150
151 /* convert from network byte order to host byte order */
152 sport = ntohs( th->source_port );
153 dport = ntohs( th->destination_port );
154
155 /* print ip addresses and udp ports */
156 printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n",
157 ih->saddr.byte1,
158 ih->saddr.byte2,
159 ih->saddr.byte3,
160 ih->saddr.byte4,
161 sport,
162 ih->daddr.byte1,
163 ih->daddr.byte2,
164 ih->daddr.byte3,
165 ih->daddr.byte4,
166 dport);
167 }
实现截图：
