Socket編程--用C#製作Sniffer

阳光穿透心脏的1/2处 2022-08-25 09:25 120阅读 0赞

Socket編程--用C\#製作Sniffer

/\*  
調試說明:在vs2003下調試通過,但在vs2005下調試不能通過,主要是多線程的問題.使用BackGroundWorker處理後,只能接收幾個封包然後就停止接收了,可能還要再學一下多線程編程,還望高手指教.

\*/

代碼已改進,現在可用了.接下來的問題是完善對各种協議的分析.還有個問題,我的計算机在局域网里面,但沒有加入域,如何才能嗅探到在域里傳遞的數据啊?

以下是源代碼:  
1.枚舉常用的變量  
public enum Precedence  
\{  
Routine = 0,  
Priority = 1,  
Immediate = 2,  
Flash = 3,  
FlashOverride = 4,  
CRITICECP = 5,  
InternetworkControl = 6,  
NetworkControl = 7  
\}  
public enum Delay  
\{  
NormalDelay = 0,  
LowDelay = 1  
\}  
public enum Throughput  
\{  
NormalThroughput = 0,  
HighThroughput = 1  
\}  
public enum Reliability  
\{  
NormalReliability = 0,  
HighReliability = 1  
\}  
public enum Protocol  
\{  
Ggp = 3,  
Icmp = 1,  
Idp = 22,  
Igmp = 2,  
IP = 4,  
ND = 77,  
Pup = 12,  
Tcp = 6,  
Udp = 17,  
Other = -1  
\}

2.將封包封裝成類  
public class Packet  
\{  
private byte\[\] m\_Raw;//保存原始封包數據  
private DateTime m\_Time;//時間  
private int m\_Version;//4位,版本  
private int m\_HeaderLength;//4位,ip頭的長度,一般都是20字節長  
private Precedence m\_Precedence;//優先級  
private Delay m\_Delay;//延時  
private Throughput m\_Throughput;//  
private Reliability m\_Reliability;//  
private int m\_TotalLength;//16位,封包總長度  
private int m\_Identification;//16位,ip包標識  
private int m\_TimeToLive;//8位,數據包在網絡上的存活時間  
private Protocol m\_Protocol;//8位,協議號  
private byte\[\] m\_Checksum;//校驗值  
private string m\_SourceAddress;//源地址  
private string m\_DestinationAddress;//目標地址  
private int m\_SourcePort;//源端口  
private int m\_DestinationPort;//目標端口  
private byte\[\] m\_data;//保存接收到的用戶數據

public Packet()  
\{  
\}

public Packet(byte\[\] raw, DateTime time)  
\{  
if (raw==null)  
\{  
throw new ArgumentNullException();  
\}  
if (raw.Length<20)  
\{  
throw new ArgumentException();  
\}  
this.m\_Raw = raw;//取原始數據包  
this.m\_Time = time;//取接收時間  
this.m\_HeaderLength = (raw\[0\] & 0xF) \* 4;//取ip頭長度  
if ((raw\[0\] & 0xF) < 5) \{throw new ArgumentException();\}//包長太短  
this.m\_Precedence = (Precedence)((raw\[1\] & 0xE0) >> 5);//取優先級  
this.m\_Delay = (Delay)((raw\[1\] & 0x10) >> 4);//取延時  
this.m\_Throughput = (Throughput)((raw\[1\] & 0x8) >> 3);//  
this.m\_Reliability = (Reliability)((raw\[1\] & 0x4) >> 2);//  
this.m\_TotalLength = raw\[2\] \* 256 + raw\[3\];//取總長度  
if ( ! (this.m\_TotalLength == raw.Length)) \{ throw new ArgumentException();\} //封包長度不正確  
this.m\_Identification = raw\[4\] \* 256 + raw\[5\];//取標識值  
this.m\_TimeToLive = raw\[8\];//取存活時間  
m\_Protocol = (Protocol)raw\[9\];//取服務類型  
m\_Checksum = new byte\[2\];//取校驗值  
m\_Checksum\[0\] = raw\[11\];  
m\_Checksum\[1\] = raw\[10\];

//此處只對tcp,udp取正確的用戶數據,其余用戶數據都不正確.  
switch(m\_Protocol)  
\{  
case Protocol.Tcp://tcp頭長20  
m\_data=new byte\[m\_TotalLength-m\_HeaderLength-20\];  
Array.Copy(raw,m\_HeaderLength+20,m\_data, 0,m\_TotalLength-m\_HeaderLength-20);  
break;  
case Protocol.Udp://udp頭長8  
m\_data=new byte\[m\_TotalLength-m\_HeaderLength-8\];  
Array.Copy(raw,m\_HeaderLength+8,m\_data, 0,m\_TotalLength-m\_HeaderLength-8);  
break;  
default:  
m\_data=new byte\[m\_TotalLength-m\_HeaderLength\];  
Array.Copy(raw,m\_HeaderLength,m\_data, 0,m\_TotalLength-m\_HeaderLength);  
break;  
\}

//取目錄地址及源地址  
try  
\{  
m\_SourceAddress = GetIPAddress(raw, 12);  
m\_DestinationAddress = GetIPAddress(raw, 16);  
\}  
catch (Exception e)  
\{  
throw;  
\}  
//取目標端口及源端口  
if (m\_Protocol == Protocol.Tcp || m\_Protocol == Protocol.Udp)  
\{  
m\_SourcePort = raw\[m\_HeaderLength\] \* 256 + raw\[m\_HeaderLength + 1\];  
m\_DestinationPort = raw\[m\_HeaderLength + 2\] \* 256 + raw\[m\_HeaderLength + 3\];  
\}  
else  
\{  
  
m\_SourcePort = -1;  
m\_DestinationPort = -1;  
\}  
\}

public int HeaderLength  
\{  
get  
\{  
return m\_HeaderLength;  
\}  
\}  
public string Data  
\{  
get  
\{  
string result="";  
System.Text.ASCIIEncoding ac=new ASCIIEncoding();  
result = ac.GetString(m\_data);  
return result;  
\}  
\}  
public string GetIPAddress(byte\[\] bArray, int nStart)  
\{  
byte\[\] tmp = new byte\[4\];  
if (bArray.Length > nStart + 2)  
\{  
tmp\[0\] = bArray\[nStart\];  
tmp\[1\] = bArray\[nStart + 1\];  
tmp\[2\] = bArray\[nStart + 2\];  
tmp\[3\] = bArray\[nStart + 3\];  
\}  
return tmp\[0\] + "." + tmp\[1\] + "." + tmp\[2\] + "." + tmp\[3\];  
\}  
public int TotalLength  
\{  
get \{ return m\_TotalLength; \}  
\}  
public DateTime Time  
\{  
get \{ return this.m\_Time; \}  
\}  
public Protocol Protocol  
\{  
get \{ return this.m\_Protocol; \}  
\}  
public string SourceAddress  
\{  
get \{ return this.m\_SourceAddress; \}  
\}  
public string Source  
\{  
get  
\{  
if ( m\_SourcePort != -1 )  
\{  
return SourceAddress.ToString() + ":" + m\_SourcePort.ToString();  
\}  
else  
\{  
return SourceAddress.ToString();  
\}  
\}  
\}  
public string Destination  
\{  
get  
\{  
if (this.m\_DestinationPort != -1)  
\{  
return DestinationAddress.ToString() + ":" + m\_DestinationPort.ToString();  
\}  
else  
\{  
return DestinationAddress.ToString();  
\}  
\}  
\}  
public string DestinationAddress  
\{  
get  
\{  
return m\_DestinationAddress;  
\}  
\}  
\}

3.封裝一個用於接收及處理封包的類  
public class Monitor  
\{  
public delegate void NewPacketEventHandler(Monitor m, Packet p);  
public event NewPacketEventHandler NewPacket;  
private Socket m\_Monitor;//建立用於接收信息的Socket  
private IPAddress m\_Ip;//本地ip  
private byte\[\] m\_Buffer = new byte\[65535\];//保存接收數據

private const System.Int32 IOC\_VENDOR = 0x18000000;  
private const int IOC\_IN = -2147483648;  
private const int SIO\_RCVALL = IOC\_IN ^ IOC\_VENDOR ^ 1;//接收所有封包  
private const int SECURITY\_BUILTIN\_DOMAIN\_RID = 0x20;  
private const int DOMAIN\_ALIAS\_RID\_ADMINS = 0x220;

public System.Net.IPAddress IP  
\{  
get \{ return m\_Ip; \}  
\}  
public byte\[\] Buffer  
\{  
get \{ return m\_Buffer; \}  
\}  
public Monitor()  
\{  
//  
// TODO: 在此添加构造函數  
//  
\}  
public Monitor(IPAddress IpAddress)  
\{  
if (!(Environment.OSVersion.Platform == PlatformID.Win32NT) && Environment.OSVersion.Version.Major<5)  
\{  
throw new NotSupportedException("This program requires Windows 2000, Windows XP or Windows .NET Server!");  
\}  
m\_Ip = IpAddress;  
\}

//開始偵聽  
public void Start()  
\{  
if (m\_Monitor==null)  
\{  
try  
\{  
// 初始化接收Socket  
m\_Monitor = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);  
// bind到本地端口  
m\_Monitor.Bind(new IPEndPoint(IP, 0));  
// 設定Socket低階作業模式  
m\_Monitor.IOControl(SIO\_RCVALL, BitConverter.GetBytes(1), null);  
// 開始接收封包數據  
m\_Monitor.BeginReceive(m\_Buffer, 0, m\_Buffer.Length, SocketFlags.None, new AsyncCallback(OnReceive), null);

\}  
catch (Exception e)  
\{  
m\_Monitor = null;  
throw new SocketException();  
\}  
\}  
\}

//處理封包  
public void OnReceive(System.IAsyncResult ar)  
\{  
try  
\{  
// 完成接收封包數據  
int received = m\_Monitor.EndReceive(ar);  
try  
\{  
if (m\_Monitor!=null)  
\{  
byte\[\] pkt = new byte\[received\];  
// 將封包轉化為字節數組  
Array.Copy(Buffer, 0, pkt, 0, received);  
// 處理封包數據  
OnNewPacket(new Packet(pkt, DateTime.Now));  
\}  
\}  
catch(Exception e)  
\{  
throw;  
\}  
// 繼續開始接收新的封包  
m\_Monitor.BeginReceive(Buffer, 0, Buffer.Length, SocketFlags.None,new AsyncCallback(OnReceive), null);  
\}  
catch (Exception e)  
\{  
throw;  
\}  
\}  
//處理封包的函數  
protected void OnNewPacket(Packet p)  
\{  
NewPacket(this, p);  
\}

//停止偵聽  
public void Stop()  
\{  
if (m\_Monitor!=null)  
\{  
m\_Monitor.Close();//關閉Socket  
\}  
m\_Monitor = null;  
\}  
\}

4.主程序  
private Monitor m\_Monitor;  
private ArrayList m\_Packets;  
private int m\_PacketsSize;

private void button1\_Click(object sender, System.EventArgs e)  
\{  
if(this.button1.Text=="開始監控")  
\{  
this.statusBar1.Text="監控中...";

this.richTextBox1.Text="";  
m\_PacketsSize=0;

StartMonitor() ;  
this.button1.Text="停止監控";  
\}  
else  
\{  
m\_Monitor.Stop();  
this.button1.Text="開始監控";  
this.statusBar1.Text="已經停止監控";

private void StartMonitor()  
\{  
IPAddress\[\] hosts = Dns.Resolve(Dns.GetHostName()).AddressList;  
if (hosts.Length == 0) \{ throw new NotSupportedException("This computer does not have non-loopback interfaces installed!");\}  
  
m\_Packets = new ArrayList();  
m\_Monitor = new Monitor(hosts\[0\]);  
//添加代理,每次有新的packet到時都觸發下面那個動作  
m\_Monitor.NewPacket+=new Monitor.NewPacketEventHandler(this.OnNewPacket);  
m\_Monitor.Start();  
\}

/\*//這個方法用於把packet顯示到richTextBox1中  
private void OnNewPacket(Monitor m, Packet p)  
\{  
m\_Packets.Add(p);  
m\_PacketsSize += p.TotalLength;  
try  
\{  
this.richTextBox1.AppendText(m\_Packets.Count.ToString()+"/t時間:"+p.Time.ToString()+"協議:"+p.Protocol.ToString()+"/t源:"+p.Source.ToString()+" /t目標:"+p.Destination.ToString()+"/t總長:"+p.TotalLength.ToString("0000"));  
this.richTextBox1.AppendText("/r");  
this.richTextBox1.AppendText("/t內容:"+p.Data);  
\}  
catch (Exception e)  
\{  
MessageBox.Show(e.Message);  
\}  
statusBar1.Text = String.Format("Intercepted \{0\} packet(s) \[\{1\} bytes\]", m\_Packets.Count, m\_PacketsSize);  
\} \*/

改進: 將上面那段注釋掉的代碼改為以下內容,這個Sniffer就可以用了.在vs2005下運行成功.沒有在vs2003下做測試.但也應該可以用.

//這個方法用於把packet顯示到richTextBox1中  
private void OnNewPacket(Monitor m, Packet p)  
\{  
m\_Packets.Add(p);  
m\_PacketsSize += p.TotalLength;  
try  
\{  
string result = m\_Packets.Count.ToString() + "/t時間:" + p.Time.ToString() + "協議:" + p.Protocol.ToString() + "/t源:" + p.Source.ToString() + " /t目標:" + p.Destination.ToString() + "/t總長:" + p.TotalLength.ToString("0000");  
result += "/r/n";  
result += "/t內容:" + p.Data;  
result += "/r/n";  
CalcFinished(result);//计算完成需要在一个文本框里显示  
\}  
catch (Exception e)  
\{  
MessageBox.Show(e.Message);  
\}  
\}

delegate void changeText(string result);  
private void CalcFinished(string result)  
\{  
if (this.InvokeRequired)  
\{  
this.BeginInvoke(new changeText(CalcFinished), result);  
\}  
else  
\{  
this.richTextBox1.AppendText(result);  
statusBar1.Text = String.Format("Intercepted \{0\} packet(s) \[\{1\} bytes\]", m\_Packets.Count, m\_PacketsSize);  
\}  
\}