Question

我正尝试在Java中构建一个透明代理，以便能够记录通过的数据，以便稍后在Wireshark中查看。

我能够使用此代码段使代理正常工作

private static final int BUFFER_SIZE = 8192;

...

public void run() {
    PcapHandle handle = null;
    PcapDumper dumper;
    try {
        InetAddress addr = InetAddress.getByName("localhost");
        PcapNetworkInterface nif = Pcaps.getDevByAddress(addr);
        int snapLen = 65536;
        PcapNetworkInterface.PromiscuousMode mode = PcapNetworkInterface.PromiscuousMode.PROMISCUOUS;
        int timeout = 10;
        handle = nif.openLive(snapLen, mode, timeout);
        dumper = handle.dumpOpen("cap.pcap");
        byte[] buffer = new byte[BUFFER_SIZE];
        try {
            while (true) {
                int bytesRead = mInputStream.read(buffer);
                if (bytesRead == -1)
                    break; // End of stream is reached --> exit
                mOutputStream.write(buffer, 0, bytesRead);
                dumper.dumpRaw(Arrays.copyOfRange(buffer, 0, bytesRead));                    
                mOutputStream.flush();
            }
        } catch (IOException e) {
            // Read/write failed --> connection is broken
        }
        dumper.close();
    } catch (PcapNativeException e) {
        e.printStackTrace();
    } catch (UnknownHostException e) {
        e.printStackTrace();
    } catch (NotOpenException e) {
        e.printStackTrace();
    }
}

您可能会注意到，我正在使用Pcap4J将原始字节存储到pcap文件中。字节的保存效果很好，但是当我尝试在Wireshark上打开它时，显示以下消息：

Error

每个数据包都显示为格式错误。理想情况下，我会看到TCP和CQL（Cassandra）数据包。

有人可以告诉我我在做什么错吗？

将Java原始InputStream数据存储为PCAP以在Wireshark中查看

0 个答案: