使用sharppcap抓数据包

首先用到PacketDotNet,SharpPcap这两个DLL,工具Ethereal可以分析包内容

class Program
{
static bool showDetails = false ; // 查看详情的参数
private static bool BackgroundThreadStop = false ; // 线程停止标识
private static object QueueLock = new object (); // 线程锁变量
private static List < PacketDotNet.RawPacket > PacketQueue = new List < PacketDotNet.RawPacket > (); // 待处理数据包队列

static void Main( string [] args)
{
// 显示SharpPcap版本
string ver = SharpPcap.Version.VersionString;
Console.WriteLine( " SharpPcap {0} " , ver);

// 获取网络设备
var devices = LivePcapDeviceList.Instance;
if (devices.Count < 1 )
{
Console.WriteLine( " 找不到网络设备 " );
return ;
}
Console.WriteLine();
Console.WriteLine( " 以下是目前本计算机上的活动网络设备: " );
Console.WriteLine( " ---------------------------------------------------- " );
Console.WriteLine();
int i = 0 ;
foreach (LivePcapDevice dev in devices)
{
Console.WriteLine( " {0}) {1} {2} " , i, dev.Name, dev.Description);
i ++ ;
}

// 选择要监听的网络设备
Console.WriteLine();
Console.WriteLine( " --选择一个需要监听的网络设备-- " );
i = int .Parse(Console.ReadLine());
LivePcapDevice device = devices[i];
Console.Write( " -- 请选择操作：监听通讯[C/c]，多线程监听通讯[T/t]，监听统计[F/f]，发送随机数据包[S/s]? " );
string resp = Console.ReadLine().ToUpper();
while ( ! (resp.StartsWith( " C " ) || resp.StartsWith( " F " ) || resp.StartsWith( " T " ) || resp.StartsWith( " S " )))
{
resp = Console.ReadLine().ToUpper();
}

try
{
if (resp.StartsWith( " C " ) || resp.StartsWith( " F " ) || resp.StartsWith( " T " ))
{
// 监听过滤条件
string filter = " ip and tcp " ;

// 连接设备
System.Threading.Thread backgroundThread = null ;
int readTimeoutMilliseconds = 1000 ;
if (resp.StartsWith( " F " ))
{
device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);
device.Filter = filter;
device.Mode = CaptureMode.Statistics; // 抓包统计
device.OnPacketArrival += new PacketArrivalEventHandler(device_OnPacketArrival); // 抓数据包回调事件
device.OnPcapStatistics += new StatisticsModeEventHandler(device_OnPcapStatistics); // 抓包统计回调事件
}
else if (resp.StartsWith( " C " ))
{
device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);
device.Filter = filter;
device.Mode = CaptureMode.Packets; // 抓包数据
showDetails = resp.EndsWith( " -A " ); // 当抓数据包时，检查是否要查看详情
device.OnPacketArrival += new PacketArrivalEventHandler(device_OnPacketArrival); // 抓数据包回调事件
}
else if (resp.StartsWith( " T " ))
{
backgroundThread = new System.Threading.Thread(BackgroundThread);
backgroundThread.Start();
device.Open();
device.Filter = filter;
device.Mode = CaptureMode.Packets; // 抓数据包
showDetails = resp.EndsWith( " -A " ); // 当抓数据包时，检查是否要查看详情
device.OnPacketArrival += new PacketArrivalEventHandler(device_OnThreadPacketArrival); // 抓数据包回调事件
}

Console.WriteLine();
Console.WriteLine( " -- 当前TCPdump过滤条件: \ " { 0 }\ "" , filter);
Console.WriteLine( " -- 正在监听设备 {0}, 按 '回车' 键以停止监听... " , device.Description);

// 开始监听
device.StartCapture();

// 停止监听
Console.ReadLine();
device.StopCapture();
Console.WriteLine( " -- 停止监听. " );

if (backgroundThread != null )
{
BackgroundThreadStop = true ;
backgroundThread.Join();
}
}
else if (resp.StartsWith( " S " ))
{
// 连接设备
device.Open();

// 生成随机数据包
byte [] bytes = GetRandomPacket();

try
{
// 发送数据
device.SendPacket(bytes);
SendQueue squeue = new SendQueue( 2000 );
Console.WriteLine( " -- 单个数据包发送成功. " );

for ( int j = 0 ; j < 10 ; j ++ )
{
if ( ! squeue.Add(bytes))
{
Console.WriteLine( " -- 警告: 队列大小不足以存放所有数据包，将只发送部分数据包. " );
break ;
}
}
device.SendQueue(squeue, SendQueueTransmitModes.Synchronized);
Console.WriteLine( " -- 数据包队列发送完毕. " );
}
catch (Exception e)
{
Console.WriteLine( " -- -- -- " + e.Message);
}
}
}
catch (Exception e)
{
Console.WriteLine( " -- -- -- " + e.Message);
}
finally
{
if (device.Opened)
{
// 断开设备连接
Console.WriteLine(device.Statistics().ToString());
device.Close();
Console.WriteLine( " --断开设备连接 " );
Console.Write( " 按 '回车' 键以退出... " );
Console.Read();
}
}


Console.Read();
}

/// <summary>
/// 抓包方法
/// </summary>
static void device_OnPacketArrival( object sender, CaptureEventArgs e)
{
PcapPorcessContext(e.Packet);
}

private static void PcapPorcessContext(PacketDotNet.RawPacket pPacket)
{
var time = pPacket.Timeval.Date;
var len = pPacket.Data.Length;
var layer = pPacket.LinkLayerType;

Console.WriteLine( " {0}:{1}:{2},{3} 长度={4} 第几层={5} " ,
time.Hour, time.Minute, time.Second, time.Millisecond, len, layer);

Console.WriteLine( " content is {0} " , Encoding.ASCII.GetString(pPacket.Data));

var packet = PacketDotNet.Packet.ParsePacket(pPacket); // Raw基础包对象

if (layer == PacketDotNet.LinkLayers.Ethernet) // 以太网包
{
var ethernetPacket = (PacketDotNet.EthernetPacket)packet;
System.Net.NetworkInformation.PhysicalAddress srcMac = ethernetPacket.SourceHwAddress;
System.Net.NetworkInformation.PhysicalAddress destMac = ethernetPacket.DestinationHwAddress;
Console.WriteLine( " MAC:{0} -> {1} " , srcMac, destMac);
if (showDetails)
Console.WriteLine( " 以太网包: " + ethernetPacket.ToColoredString( false ));
}
var ipPacket = PacketDotNet.IpPacket.GetEncapsulated(packet); // ip包
if (ipPacket != null )
{
System.Net.IPAddress srcIp = ipPacket.SourceAddress;
System.Net.IPAddress destIp = ipPacket.DestinationAddress;

Console.WriteLine( " IP: {0} -> {1} " , srcIp, destIp);
if (showDetails) Console.WriteLine( " IP packet: " + ipPacket.ToColoredString( false ));

var tcpPacket = PacketDotNet.TcpPacket.GetEncapsulated(packet); // TCP包
if (tcpPacket != null )
{
int srcPort = tcpPacket.SourcePort;
int destPort = tcpPacket.DestinationPort;

Console.WriteLine( " TCP Port: {0} -> {1} " , srcPort, destPort);
if (showDetails) Console.WriteLine( " TCP packet: " + tcpPacket.ToColoredString( false ));
}

var udpPacket = PacketDotNet.UdpPacket.GetEncapsulated(packet); // UDP包
if (udpPacket != null )
{
int srcPort = udpPacket.SourcePort;
int destPort = udpPacket.DestinationPort;

Console.WriteLine( " UDP Port: {0} -> {1} " , srcPort, destPort);
if (showDetails) Console.WriteLine( " UDP packet: " + udpPacket.ToColoredString( false ));
}
}
}

static ulong oldSec = 0 ;
static ulong oldUsec = 0 ;
/// <summary>
/// 抓包统计方法
/// </summary>
static void device_OnPcapStatistics( object sender, StatisticsModeEventArgs e)
{
// 计算统计心跳间隔
ulong delay = (e.Statistics.Timeval.Seconds - oldSec) * 1000000 - oldUsec + e.Statistics.Timeval.MicroSeconds;

// 获取 Bits per second
ulong bps = (( ulong )e.Statistics.RecievedBytes * 8 * 1000000 ) / delay;
/* ^ ^
| |
| |
| |
converts bytes in bits -- |
|
delay is expressed in microseconds --
*/

// 获取 Packets per second
ulong pps = (( ulong )e.Statistics.RecievedPackets * 1000000 ) / delay;

// 将时间戳装换为易读格式
var ts = e.Statistics.Timeval.Date.ToLongTimeString();

// 输出统计结果
Console.WriteLine( " {0}: bps={1}, pps={2} " , ts, bps, pps);

// 记录本次统计时间戳，以用于下次统计计算心跳间隔
oldSec = e.Statistics.Timeval.Seconds;
oldUsec = e.Statistics.Timeval.MicroSeconds;
}

/// <summary>
///
/// </summary>
private static DateTime LastStatisticsOutput = DateTime.Now;
private static TimeSpan LastStatisticsInterval = new TimeSpan( 0 , 0 , 2 );
static void device_OnThreadPacketArrival( object sender, CaptureEventArgs e)
{
// 输出设备通讯统计信息
var Now = DateTime.Now;
var interval = Now - LastStatisticsOutput;
if (interval > LastStatisticsInterval)
{
Console.WriteLine( " Device Statistics: " + ((LivePcapDevice)e.Device).Statistics());
LastStatisticsOutput = Now;
}

lock (QueueLock)
{
PacketQueue.Add(e.Packet); // 将捕获到的数据包加入处理队列
}
}

/// <summary>
/// 多线程处理数据包队列
/// </summary>
private static void BackgroundThread()
{
while ( ! BackgroundThreadStop)
{
bool shouldSleep = true ;

lock (QueueLock)
{
if (PacketQueue.Count != 0 )
{
shouldSleep = false ;
}
}

if (shouldSleep)
{
System.Threading.Thread.Sleep( 250 );
}
else // 处理队列
{
List < PacketDotNet.RawPacket > ourQueue; // 本线程待处理队列
lock (QueueLock)
{
ourQueue = PacketQueue;
PacketQueue = new List < PacketDotNet.RawPacket > ();
}

Console.WriteLine( " BackgroundThread: Local Queue Count is {0} " , ourQueue.Count);

foreach (var packet in ourQueue)
{
PcapPorcessContext(packet);
}
}
}
}

/// <summary>
/// 生成一个大小为200的随机数据包
/// </summary>
private static byte [] GetRandomPacket()
{
byte [] packet = new byte [ 200 ];
Random rand = new Random();
rand.NextBytes(packet);
return packet;
}
}