用c#监控网络流量
using System;
using System.Text;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
namespace UpdateTester
...{
/**//**//**//// <summary>
/// Monitor 的摘要说明。
/// </summary>
public class Monitor
...{
public delegate void NewPacketEventHandler(Monitor m, Packet p);
public event NewPacketEventHandler NewPacket;
private Socket m_Monitor;
private IPAddress m_Ip;
private byte[] m_Buffer = new byte[65535];
private const System.Int32 IOC_VENDOR = 0x18000000;
private const int IOC_IN = -2147483648;
private const int SIO_RCVALL = IOC_IN ^ IOC_VENDOR ^ 1;
private const int SECURITY_BUILTIN_DOMAIN_RID = 0x20;
private const int DOMAIN_ALIAS_RID_ADMINS = 0x220;
public System.Net.IPAddress IP
...{
get ...{ return m_Ip; }
}
public byte[] Buffer
...{
get ...{ return m_Buffer; }
}
public Monitor()
...{
//
// TODO: 在此处添加构造函数逻辑
//
}
public Monitor(IPAddress IpAddress)
...{
if (!(Environment.OSVersion.Platform == PlatformID.Win32NT) &&
Environment.OSVersion.Version.Major<5)
...{
throw new NotSupportedException(
"This program requires Windows 2000, Windows XP or Windows .NET Server!");
}
m_Ip = IpAddress;
}
public void Start()
...{
if (m_Monitor==null)
...{
try
...{
m_Monitor = new Socket(AddressFamily.InterNetwork,
SocketType.Raw, ProtocolType.IP);
m_Monitor.Bind(new IPEndPoint(IP, 0));
m_Monitor.IOControl(SIO_RCVALL, BitConverter.GetBytes(1), null);
m_Monitor.BeginReceive(m_Buffer, 0,
m_Buffer.Length, SocketFlags.None,
new AsyncCallback(OnReceive), null);
}
catch (Exception e)
...{
m_Monitor = null;
throw new SocketException();
}
}
}
public void Stop()
...{
if (m_Monitor!=null)
...{
m_Monitor.Close();
}
m_Monitor = null;
}
public void OnReceive(System.IAsyncResult ar)
...{
try
...{
int received = m_Monitor.EndReceive(ar);
try
...{
if (m_Monitor!=null)
...{
byte[] pkt = new byte[received];
Array.Copy(Buffer, 0, pkt, 0, received);
OnNewPacket(new Packet(pkt, DateTime.Now));
}
}
catch(Exception e)
...{
throw;
}
m_Monitor.BeginReceive(Buffer, 0, Buffer.Length,
SocketFlags.None, new AsyncCallback(OnReceive), null);
}
catch (Exception e)
...{
}
}
protected void OnNewPacket(Packet p)
...{
NewPacket(this, p);
}
}
}
using System;
using System.Text;
using System.Net;
using System.Net.Sockets;
namespace UpdateTester
...{
public enum Precedence
...{
Routine = 0,
Priority = 1,
Immediate = 2,
Flash = 3,
FlashOverride = 4,
CRITICECP = 5,
InternetworkControl = 6,
NetworkControl = 7
}
public enum Delay
...{
NormalDelay = 0,
LowDelay = 1
}
public enum Throughput
...{
NormalThroughput = 0,
HighThroughput = 1
}
public enum Reliability
...{
NormalReliability = 0,
HighReliability = 1
}
public enum Protocol
...{
Ggp = 3,
Icmp = 1,
Idp = 22,
Igmp = 2,
IP = 4,
ND = 77,
Pup = 12,
Tcp = 6,
Udp = 17,
Other = -1
}
/**//**//**//// <summary>
/// Packet 的摘要说明。
/// </summary>
public class Packet
...{
private byte[] m_Raw;
private DateTime m_Time;
private int m_Version;
private int m_HeaderLength;
private Precedence m_Precedence;
private Delay m_Delay;
private Throughput m_Throughput;
private Reliability m_Reliability;
private int m_TotalLength;
private int m_Identification;
private int m_TimeToLive;
private Protocol m_Protocol;
private byte[] m_Checksum;
private string m_SourceAddress;
private string m_DestinationAddress;
private int m_SourcePort;
private int m_DestinationPort;
public Packet()
...{
//
// TODO: 在此处添加构造函数逻辑
//
}
//
// public Packet(byte[] raw):(byte[] raw, DateTime time)
// {
// Packet(raw, DateTime.Now);
// }
public Packet(byte[] raw, DateTime time)
...{
if (raw==null)
...{
throw new ArgumentNullException();
}
if (raw.Length<20)
...{
throw new ArgumentException();
}
this.m_Raw = raw;
this.m_Time = time;
this.m_HeaderLength = (raw[0] & 0xF) * 4;
if ((raw[0] & 0xF) < 5) ...{throw new ArgumentException();}
this.m_Precedence = (Precedence)((raw[1] & 0xE0) >> 5);
this.m_Delay = (Delay)((raw[1] & 0x10) >> 4);
this.m_Throughput = (Throughput)((raw[1] & 0x8) >> 3);
this.m_Reliability = (Reliability)((raw[1] & 0x4) >> 2);
this.m_TotalLength = raw[2] * 256 + raw[3];
if ( ! (this.m_TotalLength == raw.Length))
...{
throw new ArgumentException();
} // invalid size of packet;
this.m_Identification = raw[4] * 256 + raw[5];
this.m_TimeToLive = raw[8];
m_Protocol = (Protocol)raw[9];
m_Checksum = new byte[2];
m_Checksum[0] = raw[11];
m_Checksum[1] = raw[10];
try
...{
m_SourceAddress = GetIPAddress(raw, 12);
m_DestinationAddress = GetIPAddress(raw, 16);
}
catch (Exception e)
...{
throw;
}
if (m_Protocol == Protocol.Tcp || m_Protocol == Protocol.Udp)
...{
m_SourcePort = raw[m_HeaderLength] * 256 +
raw[m_HeaderLength + 1];
m_DestinationPort = raw[m_HeaderLength + 2] *
256 + raw[m_HeaderLength + 3];
}
else
...{
m_SourcePort = -1;
m_DestinationPort = -1;
}
}
public string GetIPAddress(byte[] bArray, int nStart)
...{
byte[] tmp = new byte[4];
if (bArray.Length > nStart + 2)
...{
tmp[0] = bArray[nStart];
tmp[1] = bArray[nStart + 1];
tmp[2] = bArray[nStart + 2];
tmp[3] = bArray[nStart + 3];
}
return tmp[0] + "." + tmp[1] + "." + tmp[2] + "." + tmp[3];
}
public int TotalLength
...{
get ...{ return m_TotalLength; }
}
public DateTime Time
...{
get
...{
return this.m_Time;
}
}
public Protocol Protocol
...{
get ...{ return this.m_Protocol; }
}
public string SourceAddress
...{
get ...{ return this.m_SourceAddress; }
}
public string Source
...{
get
...{
if ( m_SourcePort != -1 )
...{
return SourceAddress.ToString() + ":" +
m_SourcePort.ToString();
}
else
...{
return SourceAddress.ToString();
}
}
}
public string Destination
...{
get
...{
if (this.m_DestinationPort != -1)
...{
return DestinationAddress.ToString() + ":" +
m_DestinationPort.ToString();
}
else
...{
return DestinationAddress.ToString();
}
}
}
public string DestinationAddress
...{
get
...{
return m_DestinationAddress;
}
}
}
}
在主程序里
private Monitor[] m_PacketMonitors;
private ArrayList m_Packets;
private System.Windows.Forms.StatusBar statusBar1;
private int m_PacketsSize;
执行方法中
private void StartMonitor()
...{
IPAddress[] hosts = Dns.Resolve(Dns.GetHostName()).AddressList;
if (hosts.Length == 0)
...{
throw new NotSupportedException(
"This computer does not have non-loopback interfaces installed!");
}
for (int i=0; i<hosts.Length; i++)
...{
}
m_PacketMonitors = new Monitor[1];
m_Packets = new ArrayList();
m_PacketMonitors[0] = new Monitor(hosts[0]);
// 添加代理，每次有新的packet到时都出发下面哪个动作
m_PacketMonitors[0].NewPacket+=
new Monitor.NewPacketEventHandler(this.OnNewPacket);
m_PacketMonitors[0].Start();
}
// 这个方法用于把packet显示到一个地方
private void OnNewPacket(Monitor m, Packet p)
...{
m_Packets.Add(p);
m_PacketsSize += p.TotalLength;
try
...{
txtLog.Text +=
p.Time.ToString()+p.Protocol.ToString()+
p.Source.ToString()+p.Destination.ToString()+
p.TotalLength.ToString();
}
catch (Exception e)
...{
MessageBox.Show(e.Message);
}
statusBar1.Text =
String.Format("Intercepted {0} packet(s) [{1} bytes]",
m_Packets.Count, m_PacketsSize);
}
