Question

我尝试使用SharpPcap库捕获数据包。我能够返回数据包的详细信息，但是我在获取数据包中的消息内容时遇到了问题。

使用.Data返回消息的数据包，当我使用它时它返回（System.Byte []）。

这是图书馆网站： http://www.codeproject.com/KB/IP/sharppcap.aspx

这是我的代码：

string packetData;
        private void packetCapturingThreadMethod()
            {

            Packet packet = null;
           int countOfPacketCaptures = 0;

            while ((packet = device.GetNextPacket()) != null)
                {

                packet = device.GetNextPacket();
                if (packet is TCPPacket)
                    {
                    TCPPacket tcp = (TCPPacket)packet;
                    myPacket tempPacket = new myPacket();

                    tempPacket.packetType = "TCP";
                    tempPacket.sourceAddress = Convert.ToString(tcp.SourceAddress);
                    tempPacket.destinationAddress = Convert.ToString(tcp.DestinationAddress);
                    tempPacket.sourcePort = Convert.ToString(tcp.SourcePort);
                    tempPacket.destinationPort = Convert.ToString(tcp.DestinationPort);
                    tempPacket.packetMessage = Convert.ToString(tcp.Data);
                    packetsList.Add(tempPacket);

                     packetData = 
                        "Type= TCP" +
                        "   Source Address = "+  Convert.ToString(tcp.SourceAddress)+
                       "   Destination Address =" +Convert.ToString(tcp.DestinationAddress)+
                       "   SourcePort =" +    Convert.ToString(tcp.SourcePort)+
                       "   SourcePort =" +Convert.ToString(tcp.DestinationPort)+
                       "   Messeage =" + Convert.ToString(tcp.Data);
                    txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets),
            new object[] { packetData });


                    string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage };
                    try { //dgwPacketInfo.Rows.Add(row); countOfPacketCaptures++;
                    //lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures);
                    }
                    catch (Exception e) { }

                    }
                else if (packet is UDPPacket)
                    {

                    UDPPacket udp = (UDPPacket)packet;


                    myPacket tempPacket = new myPacket();

                    tempPacket.packetType = "UDP";
                    tempPacket.sourceAddress = Convert.ToString(udp.SourceAddress);
                    tempPacket.destinationAddress = Convert.ToString(udp.DestinationAddress);
                    tempPacket.sourcePort = Convert.ToString(udp.SourcePort);
                    tempPacket.destinationPort = Convert.ToString(udp.DestinationPort);
                    tempPacket.packetMessage = udp.Data.ToArray() + "\n";
                    packetsList.Add(tempPacket);

                    packetData = 
                        "Type= UDP" +
                        "   Source Address = "+  Convert.ToString(udp.SourceAddress)+
                       "   Destination Address =" +Convert.ToString(udp.DestinationAddress)+
                       "   SourcePort =" +    Convert.ToString(udp.SourcePort)+
                       "   SourcePort =" +Convert.ToString(udp.DestinationPort)+
                       "   Messeage =" + udp.Data.ToArray() + "\n";
                    string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage };
                    try {
                        //dgwPacketInfo.Rows.Add(row);
                    //countOfPacketCaptures++;
                    //lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures);
                        txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets),
               new object[] { packetData });

                    }
                    catch (Exception e) { }


                    }


                }
            }

Answer 1

我找到了答案......

数据是一个字节数组，因此我需要使用位转换器而不是使用：

Convert.ToString(tcp.Data);

我应该使用：

BitConverter.ToString(tcp.Data)

Answer 2

解析器并不复杂......

我查看了Packet.Net代码（这是SharpPcap的解析），所有字段都以常用格式存储。

IP地址以System.Net.IPAddress格式存储，因此您只需在它们上调用.ToString即可获得正确包含点标记的文本字符串。

端口号存储为ushort，可以与任何其他整数一样打印。

需要以二进制形式解释的唯一部分是数据字段，因为它根据下一层使用的协议而变化。 SharpPcap / Packet.Net已经完成了大部分工作，字段以最方便或相同的形式存储在协议规范中。只需使用intellisense检查字段的类型，如果它不是您熟悉的类型（例如System.Net.IPAddress或System.NetworkInformation.PhysicalAddress（对于MAC地址）），只需谷歌。

SharpPcap - 数据包捕获遇到了混乱问题

2 个答案: