打造自己的网络抓包工具

// CaptureData.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <WinSock2.h>
#include <filesystem>
#include <mstcpip.h>//SIO_RCVALL头文件

#pragma comment(lib,"WS2_32.lib")//加载%system32 目录下的ws2_32.dll
#define OK 0
#define ERR -1

#define HOST_NAME_MAX 100
#define MY_PORT 10000//大于1024，,以下的端口大部分被系统占用
#define BUFF_LEN 65536//为啥是6结尾呢，

//收到的包，是网络字节序（大字节序）
typedef struct IP_HEADER
{
    char cVer : 4;//位域,char占8个比特位，这只要4个位的意思
    char cHeadLen : 4;
    char cTos;
    unsigned short usLen;
    unsigned short usIdent;
    unsigned short usFlag : 3;
    unsigned short usOffset : 13;
    char cTTL;
    char cProtocol;//用的什么协议
    unsigned short usChkSum;
    unsigned int uiSrcIp;
    unsigned int uiDstIp;
}IP_HEADER_S;

void PrintData(char szBuf[], int iLen)
{
    //printf("RCV:%s\n", szBuf);
    //打印16进制数据，可以看到内存是怎么存的，每个比特位是什么可以更清楚
    int i;
    IP_HEADER_S *pstHeader;
    SOCKADDR_IN stAddr = {};
    pstHeader = (IP_HEADER_S*)szBuf;

    //只要什么包的意思,可以试试自己ping自己，能看到4进4出的数据
    if (pstHeader->cProtocol != IPPROTO_ICMP)return;

    printf("RCV:");
    printf("Version:%d\n", pstHeader->cVer);
    printf("HeaderLen:%d\n", pstHeader->cHeadLen);
    printf("DataLen:%d\n", ntohs(pstHeader->usLen));//网络包的int转换
    printf("TTL:%d\n", pstHeader->cTTL);
    printf("FLAG_OFFSET:[%d,%d]\n", pstHeader->usFlag, pstHeader->usOffset);
    printf("Protocol:%d\n", pstHeader->cProtocol);

    stAddr.sin_addr.s_addr = pstHeader->uiSrcIp;
    //inet_ntoa()//把in_addr转成字符串IP
    printf("Source IP:%s\n", inet_ntoa(stAddr.sin_addr));

    stAddr.sin_addr.s_addr = pstHeader->uiDstIp;
    printf("Dest IP:%s\n", inet_ntoa(stAddr.sin_addr));

    //for (i = 0; i < iLen; ++i)
    //{
    //    //一个字节的字符，asc范围是0x0 到 0xff
    //    printf("%x02x ", szBuf[i] & 0xff);
    //}

    printf("\n");
}

int CaptureData()
{
    WSADATA stWsa;
    char szHostName[HOST_NAME_MAX] = {};
    HOSTENT *pHost;
    SOCKADDR_IN strAddr = { 0 };//抓包地址
    SOCKET iFd;
    int iRet;
    DWORD dwInBuff = 1;
    DWORD dwOutBuff;
    DWORD dwRet;
    char szBuf[BUFF_LEN] = { 0 };

    //0x0202表示动态链接库的版本号
    if (WSAStartup(0x0202, &stWsa) != OK)//打开动态链接库，使网络函数可用
    {
        return ERR;
    }

    //获取自己的ip地址，抓包发到这个ip地址的包
    //1获取主机名，2通过主机名获取ip
    if (gethostname(szHostName, HOST_NAME_MAX) != OK)
    {
        WSACleanup();
        return ERR;
    }

    pHost = gethostbyname(szHostName);

    printf("MYIP:%d.%d.%d.%d\n", pHost->h_addr_list[0][0] & 0xff, pHost->h_addr_list[0][1] & 0xff, pHost->h_addr_list[0][2] & 0xff, pHost->h_addr_list[0][3] & 0xff);//& 0xff的作用对ip地址转%d的int后的前面部分无用字节去掉

    strAddr.sin_family = AF_INET;
    strAddr.sin_addr.s_addr = *(unsigned long*)pHost->h_addr;//对字符数字强制转换
    strAddr.sin_port = htons(MY_PORT);

    //SOCK_RAW 抓取底层数据包（原始数据流）
    iFd = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (iFd < 0)
    {
        WSACleanup();
        return ERR;
    }

    if (bind(iFd, (SOCKADDR*)&strAddr, sizeof(SOCKADDR)) != OK)
    {
        WSACleanup();
        closesocket(iFd);
        return ERR;
    }

    //定义收包的规则
    iRet = WSAIoctl(iFd, SIO_RCVALL, &dwInBuff, sizeof(dwInBuff), &dwOutBuff, sizeof(dwOutBuff), &dwRet, NULL, NULL);
    if (iRet != OK)
    {
        WSACleanup();
        closesocket(iFd);
        return ERR;
    }

    while (true)
    {
        memset(szBuf, 0, BUFF_LEN);

        iRet = recv(iFd, szBuf, BUFF_LEN, 0);//返回接收数据的长度
        if (iRet < 0)
        {
            break;
        }
        else
        {
            PrintData(szBuf, iRet);
        }
    }



    closesocket(iFd);
    WSACleanup();
    return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
    CaptureData();
    system("pause");
    return 0;
}