ARP 协议数据包的捕获解析设计与.pptx

ARP 协议数据包的捕获解析设计与实现李彦婵、赵玉翠一、ARP数据包结构struct arppkt{ unsigned short hdtyp; //硬件地址 unsigned short protyp; //协议类型 unsigned char hdsize; //硬件地址长度 unsigned char prosize; //协议地址长度 unsigned short op; //操作值 u_char smac[6]; //源MAC地址 u_char sip[4]; //源IP地址 u_char dmac[6]; //目的MAC地址 u_char dip[4]; //目的IP地址 };二、获取网卡列表 /* get local devices */ if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING,NULL,alldevs,errbuf) == -1) { fprintf(stderr,Error in pcap_findalldevs_ex:%s\n,errbuf); exit(1); }if(inum1||inumi) { printf(\nInterface number out of range.\n); }/* print devices list */ for (d = alldevs;d != NULL; d = d-next ) { printf(%d. %s,++i,d-name); if (d-description) printf((%s)\n,d-description); else printf((No description avaliable)\n); } if (i == 0) { printf(\nNo interfaces found! Make sure Winpcap is installed.\n); return -1; } printf(Enter the interface number(1-%d):,i); scanf(%d,inum);以混乱模式打开网络设备 for(d=alldevs;d;d=d-next) { //以混杂模式打开网卡,接受所有的帧 if((adhandle= pcap_open_live(d-name,1000,1,300,errbuf)) == NULL) { cout\nUnable to open the adapter.; pcap_freealldevs(alldevs); //释放设备列表 return 0; } if(pcap_datalink(adhandle) == DLT_EN10MB d-addresses != NULL) break; } if(d==NULL) { cout\nNO interfaces found! Make sure winpcap is installed.\n; return 0; }编辑过滤器并设置过滤器，只捕获ARP数据包//获得子网掩码 netmask=((sockaddr_in *) (d-addresses-netmask))-sin_addr.S_un.S_addr; //调试过滤器，只捕获ARP包 if(pcap_compile(adhandle, fcode,packet_filter,1,netmask) 0) { cout\nUnable to compile the packet filter. Check the syntax.\n; pcap_freealldevs(alldevs); return 0; }//设置过滤器 if (pcap_setfilter(adhandle, fcode)0) { cout\nError setting the filter.\n; pcap_freealldevs(alldevs); return 0; } cout\t\tlistening on d-description...endlendl; ofstream fout(argv[1],ios::app); //日志记录文件 //加入日期记录 time_t t; time(t); fout.seekp(0,ios::end); if(fout.tell