Wireshark的Pcap文件格式分析及解析源码（转）
Pcap文件头24B各字段说明：
1 Ethernet, and Linux loopback devices
6 802.5 Token Ring
7 ARCnet
8 SLIP
9 PPP
10 FDDI
100 LLC/SNAP-encapsulated ATM
101 "raw IP", with no link
102 BSD/OS SLIP
103 BSD/OS PPP
104 Cisco HDLC
105 802.11
108 later OpenBSD loopback devices (with the AF_value in network byte order)
113 special Linux "cooked" capture
114 LocalTalk
typedef struct tagIpHead
{
int version;//版本
int headLength; //头长度
int diffsever;
int totallength; //总长度
int identification;
int flag;
int fragment;
int ttl;
int protocoltype; //协议类型
int checksum;
unsigned long srcip;//源ip
unsigned long dstip;//目的ip
}IP_HEAD;
typedef struct tagUdpHead
{
unsigned short srcport; //源端口
unsigned short dstport; //目的端口
int length; //udp包长度
}UDP_HEAD;
unsigned long FileParse::Parse( const char* FileName,bool& bThreadRun)//,HWND hwnd )
{
if (_wass_session)
{
delete _wass_session;
_wass_session = NULL;
}
_wass_session = new WassSessions();
//////////////////////////////////////////////////////////////////////////
unsigned long lRes =0;
FILE* pFile=NULL;
int nReadSize = 0;
char buff[FILE_READ_LEN];
char acip[30];
char portalip[30];
char radiusip[30];
unsigned long timestamp1;
unsigned long timestamp2;
CConfigure* config=new CConfigure();
if (config)
{
//读取ip地址，添加到iplist中
unsigned long ipTmp=0;
unsigned short portTmp=0;
config->getIPConfig(acip,portalip,radiusip);
cut_ip(acip,ipTmp,portTmp);
acport_list.push_back(portTmp);
acip_list.push_back(ipTmp);
cut_ip(portalip,ipTmp,portTmp);
portalip_list.push_back(ipTmp);
portalport_list.push_back(portTmp);
delete config;
config = NULL;
}
//////////////////////////////////////////////////////////////////////////
memset(buff,0,FILE_READ_LEN);
do
{
pFile =fopen(FileName,"rb");
//pFile =_open( FileName, _O_RDONLY | _O_BINARY );
if (!pFile)
{
//failed for the file opened
fprintf(stderr, "Open the file failed:%s ", strerror(errno));
lRes = 2;
break;
}
nReadSize = fread(buff,sizeof(char),24,pFile);
if (nReadSize == 24)
{
while (!feof(pFile) && bThreadRun)
{
memset(buff,0,FILE_READ_LEN);
nReadSize = fread(buff,sizeof(char),16,pFile);
unsigned long nPacketLen=0;
memcpy(×tamp1,buff,4);
memcpy(×tamp2,buff+4,4);
memcpy(&nPacketLen,buff+8,4);
//nPacketLen = ntohl(nPacketLen);
char* buf = new char[nPacketLen];
memset(buf,0,nPacketLen);
int nReadCount=0;
//读取包
while (nReadCount < nPacketLen)
{
nReadSize = fread(buff,sizeof(char),nPacketLen-nReadCount,pFile);
memcpy(buf+nReadCount,buff,nReadSize);
nReadCount += nReadSize;
}
//在此处处理ip/udp包部分
int nOffset=14;//数据偏移位置
_ip->Parse(buf+nOffset);//ip解析
if(_ip->wass_ip_head.protocoltype==17)//只处理UDP
{
nOffset += 20;
_udp->Parse(buf+nOffset);//udp解析
nOffset +=8;
std::list<unsigned long>::iterator acit= acip_list.begin();
std::list<unsigned long>::iterator portalit = portalip_list.begin();
bool bFoundIP = false;
//暂时不考虑算法,遍历ip地址
//while (acit++ != acip_list.end())
for (;acit != acip_list.end();acit++)
{
unsigned long aIP = *acit;
char aTmp[20];
IPULongToString(aIP,aTmp);
IPULongToString(_ip->wass_ip_head.dstip,aTmp);
if (_ip->wass_ip_head.dstip== *acit || _ip->wass_ip_head.srcip == *acit)
{
for (;portalit !=portalip_list.end();portalit++)
{
if (_ip->wass_ip_head.dstip== *portalit || _ip->wass_ip_head.srcip == *portalit)
{
bFoundIP = true;
break;
}
}
break;
}
}
if (bFoundIP)
{
//此处是表示可以进行数据的解析
_portalPacket = new CPortalPacket();
_portalPacket->parse(buf + nOffset,nPacketLen - nOffset);
//设置包的源IP和目的IP，源端口，目的端口
_portalPacket->setIpAndPort(_ip->wass_ip_head.srcip,
_ip->wass_ip_head.dstip,_udp->wass_udp_head.srcport,_udp->wass_udp_head.dstport);
_portalPacket->setPacketTime(timestamp1,timestamp2);
_wass_session->AddPacket(_portalPacket,_sessions);
}
else
{
}
}
if (buf)
{
delete [] buf;
}
}
}
} while (false);
if (pFile)
{
fclose(pFile);
}
//////////////////////////////////////////////////////////////////////////
//::PostMessage(_hwnd,WM_FINISHED,0,0);
return lRes;
}
发表于： 2010-11-05，修改于： 2010-11-05 20:08。
