Question

我一直致力于数据包嗅探器只是为了娱乐/教育而且它一直都很顺利。我遇到的问题是recvfrom()中出现的唯一数据包是SENT数据包，即我的IP作为源IP的数据包，而不是我的WAN IP，而是我的LAN IP（如果这是有道理的）。我试着修理它并花了几个小时阅读我能找到的所有东西，但对我来说似乎没有解决方案。我100％肯定我写的代码没有检测到所有数据包，因为wireshark检测到更多（进入和传出）并且显而易见的是，我的PC不仅有传出流量。

packetsize = recvfrom(sniffer , Buffer , 65536 , 0 , (SOCKADDR *)&SenderAddr , &SenderAddrSize); 
for (int x = 12; x < 16; x++) 
{
    printf("%c ",Buffer[x]); 
}
std::cout << "\n";

iphdr = (IPV4_HDR *)Buffer;

memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iphdr->ip_srcaddr;
std::cout << inet_ntoa(source.sin_addr) << "\n\n";

这一切都在下降（有更多的代码但不重要），结构都被正确定义，因此没有错误（否则我无法获得相同的结果） IP地址在每个数据包中反复发送）。另外，我网络中存在另一个不存在的IP，显示为源IP，偶尔IP源为0.0.0.0，我觉得很奇怪。

缓冲区声明为

char *Buffer = (char *)malloc(65536);

所以它签了字，我不知道我怎么能手动＆＃34;提取＆＃34;标题的单独部分来自这些值。

我希望任何人都可以向我解释，recvfrom实际上并没有丢失数据包，而且我做错了什么。另外，我想知道如何解释recvfrom的输出，即将签名转换为无符号或者其他方式？

我希望我能提前解决问题。

编辑。我代码的大部分

int main()
{
    SOCKET sniffer;
    struct in_addr addr;
    int in;

    char hostname[100];
    struct hostent *local;
    WSADATA wsa;


    // Initialise Winsock

    printf("\nInitialising Winsock...");
    if (WSAStartup(MAKEWORD(2,2), &wsa) != 0)
    {
        printf("WSAStartup() failed.\n");
        getchar();
        return 1;
    }
    printf("Initialised");

    // Create a RAW Socket
    printf("\nCreating RAW Socket....");
    sniffer = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (sniffer == INVALID_SOCKET)
    {
        printf("Failed to create raw socket.\n");
        printf("WSA throws error code %d\n",WSAGetLastError());
        printf("Run as admin to fix\n");
        getchar();
        return 1;
    }
    printf("Created.");

    // Retrieve the local hostname
    if (gethostname(hostname, sizeof(hostname)) == SOCKET_ERROR)
    {
        printf("WSA throws error code %d\n",WSAGetLastError());
        getchar();
        return 1;
    }
    printf("\nHost name : %s \n",hostname);

    bool retry = true;
    signed int maxnumber = -1;

    do
    {
        // Retrieve the available IPs of the local host
        local = gethostbyname(hostname);
        printf("\nAvailable Network Interfaces  \n");
        if (local == NULL)
        {
            printf("WSA throws error code %d.\n",WSAGetLastError());
            getchar();
            return 1;
        }

        // Available interfaces
        for (i = 0; local->h_addr_list[i] != 0; i++) // h_addr_list is null terminated
        {
            // local is hostent struct in which information about the host is stored
            // in_addr represents an IPv4 internet address. inet_ntoa: in_addr to string (ip adress)
            memmove(&addr, local->h_addr_list[i], sizeof(struct in_addr));
            //memmove(destination, source, number of bytes to copy)
            printf("Interface Number : %d Address : %s\n", i, inet_ntoa(addr));
            maxnumber = i;
            printf("\n");
        }

        // Choose interface
        if (maxnumber > 0)
        {
            printf("Enter the interface number you would like to sniff : ");
            scanf("%d",&in);
            printf(" in: %d | maxnumber: %d \n", in, maxnumber);
            if (in <= maxnumber)
            {
                retry = false;
            } else {
                printf("Interface number %d with adress %d does not exist \n\n", in, local->h_addr_list[in]);
            }
        }
        else
        {
            printf("Only one interface available");
            in = 0;
            retry = false;
        }
    } while (retry);

    self = addr;
    CreateFolder(self);

    memset(&dest, 0, sizeof(dest));
    memcpy(&dest.sin_addr.s_addr,local->h_addr_list[in],sizeof(dest.sin_addr.s_addr));
    dest.sin_family = AF_INET;
    dest.sin_port = htons(source.sin_port);//=0;

    printf("\nBinding socket to local system and port 0 ...");
    if (bind(sniffer,(struct sockaddr *)&dest,sizeof(dest)) == SOCKET_ERROR)
    {
        printf("bind(%s) failed.\n", inet_ntoa(addr));
        getchar();
        return 1;
    }
    printf("Binding successful");

    j=1;
    unsigned long nbytesret;
    printf("\nSetting socket to sniff...");
    if (WSAIoctl(sniffer, SIO_RCVALL, &j, sizeof(j), 0, 0, &nbytesret , 0 , 0) == SOCKET_ERROR)
    {
        printf("WSAIoctl() failed.\n");
        getchar();
        return 1;
    }
    printf("Socket set\n");
    printf("Press enter to start\n");
    getchar();

    printf("Packet Capture Statistics...\n");
    StartSniffing(sniffer); 

    printf("Ending sniffer, press enter to exit \n");
    getchar();
    closesocket(sniffer);
    WSACleanup();

    return 0;
}

void StartSniffing(SOCKET sniffer)
{
    char *Buffer = (char *)malloc(65536);
    int packetsize;

    if (Buffer == NULL)
    {
        printf("malloc() failed.\n");
    getchar();
    return;
    }

    do
    {
        packetsize = recvfrom(sniffer , Buffer , 65536 , 0 , (SOCKADDR *)&SenderAddr , &SenderAddrSize); 

        if(packetsize > 0)
        {
            ProcessPacket(Buffer, packetsize);
        }
        else
        {
            printf( "recvfrom() failed.\n");
            getchar();
        }

    }
    while (packetsize > 0);

    free(Buffer);
}

Answer 1

要从缓冲区读取无符号，请像这样使用reinterpret_cast来获取无符号指针：

unsigned char *uBuffer = reinterpret_cast<unsigned char *>(Buffer);

数据包嗅探器仅检测已发送的数据包

1 个答案: