[知识整理]使用RawSocket 抓包

    曾经写过一个远程网络抓包工具，为啥原远程抓了？在解决现网问题，或者统计数据，需要快速准确的抓取特点的网络吧。我们应用都是windows机器，经常需要抓XX服务某A机到XX服务B机的网络包，定位机器、查部署情况、IP地址、负载配置、同时操作多台设备等等都特别耗时，因为有了这个工具的设计初衷。于是开始设计使用调用Winpcap组件实现去抓，后来发现生产环境很多机器并未安装，同时winpcap 也无法支持silence方式安装。

   所以不得不想其他方案，这里就想到了RawSocket了，通过RawSocket 获取全量网络包，让后实现winpcap相同的filter 功能，将RawSocket 数据量保持为标准的pcap格式文件，问题得到完美的解决。

代码实现如下：

1. rawsocket

  public class RawSocket
    {
        private Socket _socket;
        private IPAddress _address;
        public Action<TcpPacket> OnTcpPacketCapture;
        public Action<byte[], int> OnRawDataCapure;
        public RawSocket(IPAddress address)
        {
            _address = address;
            _socket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
            _socket.Bind(new IPEndPoint(address, 0));
        }

        public bool Capture()
        {
            bool isOk = true;
            try
            {
                _socket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1);
                byte[] inBytes = new byte[] { 1, 0, 0, 0 };
                byte[] outBytes = new byte[] { 0, 0, 0, 0 };
                _socket.IOControl(IOControlCode.ReceiveAll, inBytes, outBytes);
                if (0 != outBytes[0] + outBytes[1] + outBytes[2] + outBytes[3]) { isOk = false; }
            }
            catch (SocketException)
            {
                isOk = false;
            }

            if (isOk)
            {
                while (true)
                {
                    //以太网MTU 最大为1500
                    byte[] buffer = new byte[1500];

                    int count = _socket.Receive(buffer, SocketFlags.None);

                    if (OnRawDataCapure != null)
                        OnRawDataCapure(buffer, count);

                    if (OnTcpPacketCapture != null)
                    {
                        IPPacket ip = new IPPacket(buffer,0,count);
                        Console.WriteLine(ip);
                        if (ip.Protocol == IPProtocolType.TCP)
                        {
                            TcpPacket tcp = new TcpPacket(ip);
                            OnTcpPacketCapture(tcp);
                        }
                    }
                }
            }

            return isOk;
        }

        public void Stop()
        {
            if (_socket != null)
            {
                _socket.Shutdown(SocketShutdown.Both);
                _socket.Close();
            }
        }
    }

    class SocketData
    {
        public Socket Socket { get; set; }
        public Byte[] Data { get; set; }
    }
    public class DataBuffer
    {
        public byte[] RawBuffer;
        public int RawStart;
        public int RawCount;

        private byte[] buffer;
        private int start;
        private int end;
        public int Length { get { return end - start; } }
        public byte this[int index] { get { return buffer[start + index]; } }

        public DataBuffer(byte[] data)
            : this(data, 0, data.Length) { }

        public DataBuffer(byte[] data, int start, int count)
        {
           this.RawBuffer= this.buffer = data;
           this.RawStart= this.start = start;
           this.RawCount = count;
            this.end = start + count;
        }

        public void SetPosition(int position)
        {
            this.start += position;
        }

        public byte[] Data
        {
            get
            {
                byte[] data = new byte[this.Length];
                Array.Copy(this.buffer, this.start, data, 0, data.Length);
                return data;
            }
        }
    }

    public class IPPacket
    {
        public int Version; //版本号
        public int HeadLen; //头长度
        public int DiffServices; //区分服务
        public int DataLen;//数据长度
        public int Identification; //标志
        public int Flag; //标识 3bit
        public int Excursion;//片偏移 13bit
        public byte TTL;//生存周期
        public IPProtocolType Protocol; //协议
        public int CheckSum; //校验和
        public IPAddress SrcAddr; //源地址
        public IPAddress DestAddr; //目标地址
        public byte[] option; //选项
        public DataBuffer Data; //IP Payload

        public IPPacket(byte[] data) : this(new DataBuffer(data)) { }
        public IPPacket(byte[] data, int start, int count) : this(new DataBuffer(data, start, count)) { }

        public IPPacket(DataBuffer data)
        {
            Version = (data[0] & 0xF0) >> 4;
            HeadLen = (int)(data[0] & 0x0F) * 4;
            DiffServices = (int)data[1];
            DataLen = ((int)data[2] << 8) + (int)data[3];
            Identification = ((int)data[5] << 8) + (int)data[5];
            Flag = data[6] >> 5;
            Excursion = (((int)data[6] & 0x1F) << 8) + (int)data[7];
            TTL = data[8];
            Protocol = (IPProtocolType)data[9];
            CheckSum = ((int)data[10] << 8) + (int)data[11];

            byte[] addr = new byte[4];
            for (int i = 0; i < 4; i++)
                addr[i] = data[12 + i];
            SrcAddr = new IPAddress(addr);

            addr = new byte[4];
            for (int i = 0; i < 4; i++)
                addr[i] = data[16 + i];
            DestAddr = new IPAddress(addr);

            //option
            if (HeadLen > 20)
            {
                option = new byte[HeadLen - 20];
                for (int i = 0; i < option.Length; i++)
                    option[i] = data[20 + i]; //会包括填充部分
            }

            data.SetPosition(HeadLen);
            Data = data;
        }

        public override string ToString()
        {
            StringBuilder sb = new StringBuilder();
            sb.AppendFormat("SrcAddr:{0} DestAddr={1}\r\n", SrcAddr.ToString(), DestAddr.ToString());
            sb.AppendFormat("CheckSum: {0} Protocol:{1}\r\n", CheckSum, Protocol.ToString());
            sb.AppendFormat("Version: {0} HeadLen:{1}\r\n", Version, HeadLen);
            sb.AppendFormat("DataLen: {0} DiffServices:{1}\r\n", DataLen, DiffServices);
            return sb.ToString();
        }
    }

    public class TcpPacket
    {
        public int SrcPort = 0;//源端口
        public int DestPort = 0;//目标端口
        public uint SequenceNo = 0;//序号
        public uint NextSeqNo = 0;//确认号
        public int HeadLen = 0;//头长度
        public int Flag = 0;//控制位
        public int WindowSize = 0;//窗口
        public int CheckSum = 0;//校验和
        public int UrgPtr = 0;//紧急指针
        public byte[] option;//选项
        public IPPacket IPPacket;
        public DataBuffer Data;
        public byte[] Body { get { return Data.Data; } }

        public TcpPacket(byte[] data) : this(new IPPacket(new DataBuffer(data))) { }
        public TcpPacket(byte[] data, int start, int count) : this(new IPPacket(new DataBuffer(data, start, count))) { }

        public TcpPacket(IPPacket packet)
        {
            if (packet.Protocol != IPProtocolType.TCP)
                throw new NotSupportedException(string.Format("TcpPacket not support {0}", packet.Protocol));
            this.IPPacket = packet;

            DataBuffer data = packet.Data;
            SrcPort = ((int)data[0] << 8) + (int)data[1];
            DestPort = ((int)data[2] << 8) + (int)data[3];

            SequenceNo = ((uint)data[7] << 24) + ((uint)data[6] << 16) + ((uint)data[5] << 8) + ((uint)data[4]);
            NextSeqNo = ((uint)data[11] << 24) + ((uint)data[10] << 16) + ((uint)data[9] << 8) + ((uint)data[8]);

            HeadLen = ((data[12] & 0xF0) >> 4)*4;
            //6bit保留位
            Flag = (data[13] & 0x3F);
            WindowSize = ((int)data[14] << 8) + (int)data[15];
            CheckSum = ((int)data[16] << 8) + (int)data[17];
            UrgPtr = ((int)data[18] << 8) + (int)data[19];
            //option
            if (HeadLen > 20)
            {
                option = new byte[HeadLen - 20];
                for (int i = 0; i < option.Length; i++)
                    option[i] = data[20 + i]; //会包括填充部分
            }

            data.SetPosition(this.HeadLen);
            Data = data;
        }

        public override string ToString()
        {
            StringBuilder sb = new StringBuilder();
            sb.AppendFormat("SrcPort:{0} DestPort={1}\r\n", SrcPort, DestPort);
            sb.AppendFormat("SequenceNo:{0} NextSeqNo={1}\r\n", SequenceNo, NextSeqNo);
            sb.AppendFormat("HeadLen:{0} Flag={1}\r\n", HeadLen, Flag);
            sb.AppendFormat("WindowSize:{0} CheckSum={1}\r\n", WindowSize, CheckSum);
            return sb.ToString();
        }
    }

    public enum IPProtocolType : byte
    {
        /// <summary> Dummy protocol for TCP. </summary>
        IP = 0,
        /// <summary> IPv6 Hop-by-Hop options. </summary>
        HOPOPTS = 0,
        /// <summary> Internet Control Message Protocol. </summary>
        ICMP = 1,
        /// <summary> Internet Group Management Protocol.</summary>
        IGMP = 2,
        /// <summary> IPIP tunnels (older KA9Q tunnels use 94). </summary>
        IPIP = 4,
        /// <summary> Transmission Control Protocol. </summary>
        TCP = 6,
        /// <summary> Exterior Gateway Protocol. </summary>
        EGP = 8,
        /// <summary> PUP protocol. </summary>
        PUP = 12,
        /// <summary> User Datagram Protocol. </summary>
        UDP = 17,
        /// <summary> XNS IDP protocol. </summary>
        IDP = 22,
        /// <summary> SO Transport Protocol Class 4. </summary>
        TP = 29,
        /// <summary> IPv6 header. </summary>
        IPV6 = 41,
        /// <summary> IPv6 routing header. </summary>
        ROUTING = 43,
        /// <summary> IPv6 fragmentation header. </summary>
        FRAGMENT = 44,
        /// <summary> Reservation Protocol. </summary>
        RSVP = 46,
        /// <summary> General Routing Encapsulation. </summary>
        GRE = 47,
        /// <summary> encapsulating security payload. </summary>
        ESP = 50,
        /// <summary> authentication header. </summary>
        AH = 51,
        /// <summary> ICMPv6. </summary>
        ICMPV6 = 58,
        /// <summary> IPv6 no next header. </summary>
        NONE = 59,
        /// <summary> IPv6 destination options. </summary>
        DSTOPTS = 60,
        /// <summary> Multicast Transport Protocol. </summary>
        MTP = 92,
        /// <summary> Encapsulation Header. </summary>
        ENCAP = 98,
        /// <summary> Protocol Independent Multicast. </summary>
        PIM = 103,
        /// <summary> Compression Header Protocol. </summary>
        COMP = 108,
        /// <summary> Raw IP packets. </summary>
        RAW = 255,
        /// <summary> IP protocol mask.</summary>
        MASK = 0xff
    }

2. PcapDumper 用户保存pcap文件格式：

 public class PcapDumper
    {
        private PcapStream context;
        public PcapDumper(Stream stream)
        {
            context = new PcapStream(stream);
            PcapHeader header = new PcapHeader();
            header.Writer(context);
            stream.Flush();
        }

        public void Write(byte[] buffer, int offset, int count)
        {
            RecordPacket record = new RecordPacket(buffer, offset, count);
            record.Write(context);
        }

        public void Write(TcpPacket packet)
        {
            Write(packet.IPPacket.Data.RawBuffer, packet.IPPacket.Data.RawStart, packet.IPPacket.Data.RawCount);
        }

        public void Write(IPPacket packet)
        {
            Write(packet.Data.RawBuffer, packet.Data.RawStart, packet.Data.RawCount);
        }

        public void Flush()
        {
            context.Flush();
        }
    }

    public class PcapHeader
    {
        //for intel x86 save as litle-endian
        public uint MagicNumber = 0xa1b2c3d4;// native byte ordering. magic number
        public ushort VersionMajor = 0x2; //current 2.4
        public ushort VersionMinor = 0x4;
        public uint TimeZone = 0;//timeezone 实际上没有被使用过
        public uint SigFigs = 0;//useless
        public uint Snaplen = 65535;//maxlen just set the max
        public uint Network = 1;//Ethernet

        public void Writer(PcapStream stream)
        {
            stream.Write(MagicNumber);
            stream.Write(VersionMajor);
            stream.Write(VersionMinor);
            stream.Write(TimeZone);
            stream.Write(SigFigs);
            stream.Write(Snaplen);
            stream.Write(Network);
        }
    }


    public class RecordPacket
    {
        private DateTime unixTime = new DateTime(1970, 1, 1);
        private int EntherNetLen = 14;//srcIP+dstIP+ verion 14b 头
        private int offset;
        private int count;
        private byte[] buffer;

        public RecordPacket(byte[] buffer, int offset, int count)
        {
            DateTime time = DateTime.UtcNow;
            TimeSec = (uint)((time - unixTime).TotalSeconds);
            TimeMicroSec = (uint)time.Millisecond * 1000;
            CapLen = Len = (uint)count + 14;
            this.offset = offset;
            this.count = count;
            this.buffer = buffer;
        }

        public uint TimeSec;         /* timestamp seconds */
        public uint TimeMicroSec;        /* timestamp microseconds */
        public uint CapLen;       /* number of octets of packet saved in file */
        public uint Len;       /* actual length of packet */

        public void Write(PcapStream stream)
        {
            stream.Write(TimeSec);
            stream.Write(TimeMicroSec);
            stream.Write(CapLen);
            stream.Write(Len);
            stream.Write((ulong)1, 6);
            stream.Write((ulong)2, 6); //这两个应该是链路mac地址，随便代替就行
            stream.Write(8);
            stream.Write(0);//IP 0x08
            stream.Write(buffer, offset, count);
        }
    }

    public class PcapStream
    {
        private byte[] tempBuffer = new byte[8];
        private Stream stream;
        public PcapStream(Stream stream)
        {
            this.stream = stream;
        }

        public void Flush()
        {
            stream.Flush();
        }

        public void Write(ushort v)
        {
            Write(v, 2);
        }

        public void Write(uint v)
        {
            Write(v, 4);
        }

        public void Write(ulong v)
        {
            Write(v, 8);
        }

        public void Write(ulong v, int numbytes)
        {
            ulong val = v;
            for (int x = 0; x < numbytes; x++)
            {
                tempBuffer[x] = (byte)(val & 0xff);
                val >>= 8;
            }
            stream.Write(tempBuffer, 0, numbytes);
        }

        public void Write(byte value)
        {
            stream.WriteByte(value);
        }

        public void Write(byte[] buffer, int offset, int count)
        {
            stream.Write(buffer, offset, count);
        }

        public void Write(byte[] buffer)
        {
            stream.Write(buffer, 0, buffer.Length);
        }
    }
}

/// 参考资料：http://wiki.wireshark.org/Development/LibpcapFileFormat
//magic_number: used to detect the file format itself and the byte ordering. The writing application writes 0xa1b2c3d4 with it's native byte ordering format into this field. The reading application will read either 0xa1b2c3d4 (identical) or 0xd4c3b2a1 (swapped). If the reading application reads the swapped 0xd4c3b2a1 value, it knows that all the following fields will have to be swapped too.
//version_major, version_minor: the version number of this file format (current version is 2.4)
//thiszone: the correction time in seconds between GMT (UTC) and the local timezone of the following packet header timestamps. Examples: If the timestamps are in GMT (UTC), thiszone is simply 0. If the timestamps are in Central European time (Amsterdam, Berlin, ...) which is GMT + 1:00, thiszone must be -3600. In practice, time stamps are always in GMT, so thiszone is always 0.
//sigfigs: in theory, the accuracy of time stamps in the capture; in practice, all tools set it to 0
//snaplen: the "snapshot length" for the capture (typically 65535 or even more, but might be limited by the user), see: incl_len vs. orig_len below
//network: link-layer header type, specifying the type of headers at the beginning of the packet (e.g. 1 for Ethernet, see tcpdump.org's link-layer header types page for details); this can be various types such as 802.11, 802.11 with various radio information, PPP, Token Ring, FDDI, etc.
//0            BSD       loopback devices, except for later OpenBSD
//1            Ethernet, and Linux loopback devices
//6            802.5 Token Ring
//7            ARCnet
//8            SLIP
//9            PPP
//10          FDDI
//100        LLC/SNAP-encapsulated ATM
//101        raw IP, with no link
//102        BSD/OS SLIP
//103        BSD/OS PPP
//104        Cisco HDLC
//105        802.11
//108        later OpenBSD loopback devices (with the AF_value in network byte order)
//113               special Linux cooked capture
//114               LocalTalk

//ts_sec: the date and time when this packet was captured. This value is in seconds since January 1, 1970 00:00:00 GMT; this is also known as a UN*X time_t. You can use the ANSI C time() function from time.h to get this value, but you might use a more optimized way to get this timestamp value. If this timestamp isn't based on GMT (UTC), use thiszone from the global header for adjustments.
//ts_usec: the microseconds when this packet was captured, as an offset to ts_sec.  Beware: this value shouldn't reach 1 second (1 000 000), in this case ts_sec must be increased instead!
//incl_len: the number of bytes of packet data actually captured and saved in the file. This value should never become larger than orig_len or the snaplen value of the global header.
//orig_len: the length of the packet as it appeared on the network when it was captured. If incl_len and orig_len differ, the actually saved packet size was limited by snaplen.

3. 最后是Filter功能：

class PcapFilter
   {
       private const string CONST_AND = "and";
       private const string CONST_OR = "or";
       private const string CONST_HOST = "host";
       private const string CONST_TCP = "tcp";
       private const string CONST_PORT = "port";

       private string filter;
       private Func<TcpPacket, bool> filterAction = (packet) => { return true; };
       private List<Func<TcpPacket, bool>> _funcs=new List<Func<TcpPacket,bool>>();
       private bool _isAnd = false;

       public PcapFilter(string filter)
       {
           if (!string.IsNullOrEmpty(filter))
           {
               this.filter = filter.Trim().ToLower();
               if (!string.IsNullOrEmpty(this.filter))
                   TryParserFilter();
           }
       }

       private void TryParserFilter()
       {
           string[] sp = filter.Split(new char[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
           sp = sp.Where(p => p.Trim().Length > 0).ToArray();

           if (sp.Where(p => p == CONST_OR || p == CONST_AND).Count() > 1)
               throw new NotSupportedException("only support one or/and");

           TokenState ns = TokenState.Name;
           string name = string.Empty;

           for (int i=0;i<sp.Length;i++)
           {
               if (ns == TokenState.Name)
               {
                   if (sp[i] == CONST_TCP && sp[i + 1] == CONST_PORT)
                   {
                       name = CONST_TCP;
                       i++;
                       ns = TokenState.Value;
                   }
                   else if (sp[i] == CONST_HOST)
                   {
                       name = CONST_HOST;
                       ns = TokenState.Value;
                   }
                   else
                       throw new NotSupportedException();
               }
               else if (ns == TokenState.Operation)
               {
                   if (sp[i] == CONST_AND)
                       _isAnd = true;
                   else
                       _isAnd = false;
                   ns = TokenState.Name;
               }
               else if (ns == TokenState.Value)
               {
                   ParseAction(name, sp[i]);
                   ns = TokenState.Operation;
               }
           }

           filterAction=(packet)=>
               {
                   if (_funcs.Count > 0)
                   {
                       if (_funcs.Count == 1)
                           return _funcs[0](packet);
                       else
                       {
                       if(_isAnd)
                           return _funcs[0](packet) && _funcs[1](packet);
                       }
                   }
                   return true;
               };
       }

       private void ParseAction(string name, string value)
       {
           if (name == CONST_HOST)
           {
               IPAddress ip = IPAddress.Parse(value);
               _funcs.Add(new Func<TcpPacket, bool>((pachet) =>
                   {
                       return pachet.IPPacket.SrcAddr.Equals(ip) || pachet.IPPacket.DestAddr.Equals(ip);
                   }));
           }
           else
           {
               int port = Convert.ToInt32(value);
               _funcs.Add(new Func<TcpPacket, bool>((packet) =>
                   {
                       return packet.SrcPort == port || packet.DestPort == port;
                   }));
           }
       }

       public bool IsFilter(TcpPacket packet)
       {
           return filterAction(packet);
       }
   }

   enum TokenState
   {
       Name,
       Value,
       Operation,
   }