ÍøÕ¾Éè¼Æ|ÍøÕ¾ÖÆ×÷|ÍøÕ¾½¨Éè·þÎñÍø
¡¡¡¡×ÊÉîµÄÍøÕ¾Éè¼ÆÈËÔ±£¬ÒÔ¾«Õ¿µÄÍøÕ¾Éè¼Æ¼¼Êõ¡¢ÓÅÖʵÄÍøÕ¾ÖÆ×÷·þÎñ,ΪÄúÌṩȫ·½Î»µÄÍøÕ¾Éè¼Æ¡¢ÍøÕ¾ÖÆ×÷·þÎñ£¬¾«ÐÄÍƳöÍøÕ¾ÖÆ×÷µÄ¶àÖÖ¿Æѧ·½°¸,´ÓÍøÕ¾Éè¼Æµ½ÍøÕ¾ÖÆ×÷¡¢ÍøÕ¾Íƹ㡢±£Ö¤Äú×î´óÏÞ¶ÈÓµÓÐÐÅÏ¢»¯µÄÍøÕ¾Éè¼ÆÓÅÊÆ.

Raw Socket£¨Ô­Ê¼Ì×½Ó×Ö£©ÊµÏÖSniffer£¨Ðá̽£©

Ò». ÕªÒª
Raw Socket: ԭʼÌ×½Ó×Ö
¿ÉÒÔÓÃËüÀ´·¢ËͺͽÓÊÕ IP ²ãÒÔÉϵÄԭʼÊý¾Ý°ü, Èç ICMP, TCP, UDP...

int sockRaw = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);

ÕâÑùÎÒÃǾʹ´½¨ÁËÒ»¸ö Raw Socket

Sniffer: Ðá̽Æ÷
¹ØÓÚÐá̽Æ÷µÄÔ­ÀíÎÒÏë´ó¶àÊýÈË¿ÉÄܶ¼ÖªµÀ
1. °ÑÍø¿¨ÖÃÓÚ»ìÔÓģʽ;
2. ²¶»ñÊý¾Ý°ü;
3. ·ÖÎöÊý¾Ý°ü.

µ«¾ßÌåµÄʵÏÖÖªµÀµÄÈË¿ÖžͲ»ÊÇÄÇô¶àÁË. ºÃ, ÏÖÔÚÈÃÎÒÃÇÓà Raw Socket µÄ×öÒ»¸ö×ÔÒÑµÄ Sniffer.

¶þ. °ÑÍø¿¨ÖÃÓÚ»ìÔÓģʽ
ÔÚÕý³£µÄÇé¿öÏ£¬Ò»¸öÍøÂç½Ó¿ÚÓ¦¸ÃÖ»ÏìÓ¦Á½ÖÖÊý¾ÝÖ¡:
Ò»ÖÖÊÇÓë×Ô¼ºÓ²¼þµØÖ·ÏàÆ¥ÅäµÄÊý¾ÝÖ¡
Ò»ÖÖÊÇ·¢ÏòËùÓлúÆ÷µÄ¹ã²¥Êý¾ÝÖ¡
Èç¹ûÒªÍø¿¨½ÓÊÕËùÓÐͨ¹ýËüµÄÊý¾Ý, ¶ø²»¹ÜÊDz»ÊÇ·¢¸øËüµÄ, ÄÇô±ØÐë°ÑÍø¿¨ÖÃÓÚ»ìÔÓģʽ. Ò²¾ÍÊÇ˵ÈÃËüµÄ˼ά»ìÂÒ, ²»°´Õý³£µÄ·½Ê½¹¤×÷. Óà Raw Socket ʵÏÖ´úÂëÈçÏÂ:

setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char*)&flag, sizeof(flag); //ÉèÖà IP Í·²Ù×÷Ñ¡Ïî
bind(sockRaw, (PSOCKADDR)&addrLocal, sizeof(addrLocal); //°Ñ sockRaw °ó¶¨µ½±¾µØÍø¿¨ÉÏ
ioctlsocket(sockRaw, SIO_RCVALL, &dwValue); //Èà sockRaw ½ÓÊÜËùÓеÄÊý¾Ý

flag ±êÖ¾ÊÇÓÃÀ´ÉèÖà IP Í·²Ù×÷µÄ, Ò²¾ÍÊÇ˵ҪÇ××Ô´¦Àí IP Í·: bool flag = ture;
addrLocal Ϊ±¾µØµØÖ·: SOCKADDR_IN addrLocal;
dwValue ΪÊäÈëÊä³ö²ÎÊý, Ϊ 1 ʱִÐÐ, 0 ʱȡÏû: DWORD dwValue = 1;
ûÏëµ½Õâô¼òµ¥°É?

Èý. ²¶»ñÊý¾Ý°ü
ÄãµÄ sockRaw ÏÖÔÚÒѾ­ÔÚ¹¤×÷ÁË, ¿ÉÒÔÔÚ¾ÖÓòÍøÄÚÆäËüµÄµçÄÔÉÏÓà Sniffer ¼ì²â¹¤¾ß¼ì²âÒ»ÏÂ, ¿´ÄãµÄÍø¿¨ÊÇ·ñ´¦ÓÚ»ìÔÓģʽ(±ÈÈç DigitalBrain µÄ ARPKiller).
²»ÄÜÈÃËû°×°×µÄÀË·Ñ×ÊÔ´°¡, ×¥°ü!

recv(sockRaw, RecvBuf, BUFFER_SIZE, 0); //½ÓÊÜÈÎÒâÊý¾Ý°ü

#define BUFFER_SIZE 65535
char RecvBuf[BUFFER_SIZE];
Ô½À´Ô½·¢ÏÖ Sniffer Ô­À´Èç´ËµÄ¼òµ¥ÁË, Õâôһ¸öº¯Êý¾ÍÒѾ­Íê³ÉץȡÊý¾Ý°üµÄÈÎÎñÁË.

ËÄ. ·ÖÎöÊý¾Ý°ü
Õâ»Ø×¥À´µÄ°üºÍƽ³£Óà Socket ½ÓÊܵİü¿É¾Í²»ÊÇÒ»»ØʶùÁË, ÀïÃæ°üº¬ IP, TCP µÈԭʼÐÅÏ¢. Òª·ÖÎöËüÊ×ÏȵÃÖªµÀÕâЩ½á¹¹.
Êý¾Ý°üµÄ×ÜÌå½á¹¹:
----------------------------------------------
| ip header | tcp header(or x header) | data |
----------------------------------------------

IP header structure:
4 8 16 32 bit
|--------|--------|----------------|--------------------------------|
| Ver | IHL |Type of service | Total length |
|--------|--------|----------------|--------------------------------|
| Identification | Flags | Fragment offset |
|--------|--------|----------------|--------------------------------|
| Time to live | Protocol | Header checksum |
|--------|--------|----------------|--------------------------------|
| Source address |
|--------|--------|----------------|--------------------------------|
| Destination address |
|--------|--------|----------------|--------------------------------|
| Option + Padding |
|--------|--------|----------------|--------------------------------|
| Data |
|--------|--------|----------------|--------------------------------|

TCP header structure:
16 32 bit
|--------------------------------|--------------------------------|
| Source port | Destination port |
|--------------------------------|--------------------------------|
| Sequence number |
|--------------------------------|--------------------------------|
| Acknowledgement number |
|--------------------------------|--------------------------------|
| Offset | Resrvd |U|A|P|R|S|F| Window |
|--------------------------------|--------------------------------|
| Checksum | Urgent pointer |
|--------------------------------|--------------------------------|
| Option + Padding |
|--------------------------------|--------------------------------|
| Data |
|--------------------------------|--------------------------------|

Îå. ʵÏÖ Sniffer
OK!
ÏÖÔÚ¶¼Çå³þÁË, »¹µÈʲô.
ÏÂÃæÊÇÎÒÓà BCB6 дµÄÒ»¸ö Simple Sniffer µÄ´úÂë, ½ö¹©²Î¿¼.
£¨ÐèÒªÔÚ¹¤³ÌÎļþÀï¼ÓÈëWS2_32.LIBÕâ¸öÎļþ£©
//*************************************************************************//
//* CPP file: WMain.cpp
//* Simple Sniffer by shadowstar
//* http://shadowstar.126.com/
//*************************************************************************//
#include <vcl.h>
#pragma hdrstop

#include <winsock2.h>
#include <ws2tcpip.h>
#include <mstcpip.h>
#include <netmon.h>
#include "WMain.h"
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
TMainForm *MainForm;
//---------------------------------------------------------------------------
__fastcall TMainForm::TMainForm(TComponent* Owner)
: TForm(Owner)
{
WSADATA WSAData;
BOOL flag = true;
int nTimeout = 1000;
char LocalName[16];
struct hostent *pHost;

//¼ì²é Winsock °æ±¾ºÅ
if (WSAStartup(MAKEWORD(2, 2), &WSAData) != 0)
throw Exception("WSAStartup error!");

//³õʼ»¯ Raw Socket
if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == INVALID_SOCKET)
throw Exception("socket setup error!");

//ÉèÖÃIPÍ·²Ù×÷Ñ¡Ïî
if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char*)&flag, sizeof(flag)) == SOCKET_ERROR)
throw Exception("setsockopt IP_HDRINCL error!");

//»ñÈ¡±¾»úÃû
if (gethostname((char*)LocalName, sizeof(LocalName)-1) == SOCKET_ERROR)
throw Exception("gethostname error!");

//»ñÈ¡±¾µØ IP µØÖ·
if ((pHost = gethostbyname((char*)LocalName)) == NULL)
throw Exception("gethostbyname error!");

addr_in.sin_addr = *(in_addr *)pHost->h_addr_list[0]; //IP
addr_in.sin_family = AF_INET;
addr_in.sin_port = htons(57274);

//°Ñ sock °ó¶¨µ½±¾µØµØÖ·ÉÏ
if (bind(sock, (PSOCKADDR)&addr_in, sizeof(addr_in)) == SOCKET_ERROR)
throw Exception("bind error!");

iSortDirection = 1;
}
//---------------------------------------------------------------------------
__fastcall TMainForm::~TMainForm()
{
WSACleanup();
}
//---------------------------------------------------------------------------

void __fastcall TMainForm::btnCtrlClick(TObject *Sender)
{
TListItem *Item;
DWORD dwValue;
int nIndex = 0;

if (btnCtrl->Caption == "&Start")
{
dwValue = 1;
//ÉèÖà SOCK_RAW ΪSIO_RCVALL£¬ÒÔ±ã½ÓÊÕËùÓеÄIP°ü
if (ioctlsocket(sock, SIO_RCVALL, &dwValue) != 0)
throw Exception("ioctlsocket SIO_RCVALL error!");
bStop = false;
btnCtrl->Caption = "&Stop";
lsvPacket->Items->Clear();
}
else
{
dwValue = 0;
bStop = true;
btnCtrl->Caption = "&Start";
//ÉèÖÃSOCK_RAWΪSIO_RCVALL£¬Í£Ö¹½ÓÊÕ
if (ioctlsocket(sock, SIO_RCVALL, &dwValue) != 0)
throw Exception("WSAIoctl SIO_RCVALL error!");
}

while (!bStop)
{
if (recv(sock, RecvBuf, BUFFER_SIZE, 0) > 0)
{
nIndex++;

ip = *(IP*)RecvBuf;
tcp = *(TCP*)(RecvBuf + (ip.HdrLen & IP_HDRLEN_MASK));

Item = lsvPacket->Items->Add();
Item->Caption = nIndex;
Item->SubItems->Add(GetProtocolTxt(ip.Protocol));
Item->SubItems->Add(inet_ntoa(*(in_addr*)&ip.SrcAddr));
Item->SubItems->Add(inet_ntoa(*(in_addr*)&ip.DstAddr));
Item->SubItems->Add(tcp.SrcPort);
Item->SubItems->Add(tcp.DstPort);
Item->SubItems->Add(ntohs(ip.TotalLen));
}
Application->ProcessMessages();
}
}
//---------------------------------------------------------------------------

AnsiString __fastcall TMainForm::GetProtocolTxt(int Protocol)
{
switch (Protocol)
{
case IPPROTO_ICMP : //1 /* control message protocol */
return PROTOCOL_STRING_ICMP_TXT;
case IPPROTO_TCP : //6 /* tcp */
return PROTOCOL_STRING_TCP_TXT;
case IPPROTO_UDP : //17 /* user datagram protocol */
return PROTOCOL_STRING_UDP_TXT;
default :
return PROTOCOL_STRING_UNKNOWN_TXT;
}
}
//---------------------------------------------------------------------------

//*************************************************************************//
//* Header file: WMain.h for WMain.cpp class TMainForm
//*************************************************************************//
//---------------------------------------------------------------------------

#ifndef WMainH
#define WMainH
//---------------------------------------------------------------------------
#define BUFFER_SIZE 65535

#include <Classes.hpp>
#include <Controls.hpp>
#include <StdCtrls.hpp>
#include <Forms.hpp>
#include <ComCtrls.hpp>
#include <ExtCtrls.hpp>
#include <winsock2.h>
#include "netmon.h"

//---------------------------------------------------------------------------
class TMainForm : public TForm
{
__published: // IDE-managed Components
TPanel *Panel1;
TButton *btnCtrl;
TListView *lsvPacket;
TLabel *Label1;
void __fastcall btnCtrlClick(TObject *Sender);
void __fastcall lsvPacketColumnClick(TObject *Sender,
TListColumn *Column);
void __fastcall lsvPacketCompare(TObject *Sender, TListItem *Item1,
TListItem *Item2, int Data, int &Compare);
void __fastcall Label1Click(TObject *Sender);
private: // User declarations
AnsiString __fastcall GetProtocolTxt(int Protocol);
public: // User declarations
SOCKET sock;
SOCKADDR_IN addr_in;
IP ip;
TCP tcp;
PSUHDR psdHeader;
char RecvBuf[BUFFER_SIZE];
bool bStop;

int iSortDirection;
int iColumnToSort;

__fastcall TMainForm(TComponent* Owner);
__fastcall ~TMainForm();
};
//---------------------------------------------------------------------------
extern PACKAGE TMainForm *MainForm;
//---------------------------------------------------------------------------
#endif

͵Á˸öÀÁ, IP, TCP Í·¼°Ò»Ð©ºê¶¨ÒåÓÃÁË netmon.h µÄÍ·, Õâ¸öÎļþÔÚ BCB6 µÄ include Ŀ¼Ï¿ÉÒÔÕҵõ½, ÆäÖÐÓë±¾³ÌÐòÏà¹ØÄÚÈÝÈçÏÂ:

//*************************************************************************//
//* Header file: netmon.h
//*************************************************************************//
//
// IP Packet Structure
//
typedef struct _IP
{
union
{
BYTE Version;
BYTE HdrLen;
};
BYTE ServiceType;
WORD TotalLen;
WORD ID;
union
{
WORD Flags;
WORD FragOff;
};
BYTE TimeToLive;
BYTE Protocol;
WORD HdrChksum;
DWORD SrcAddr;
DWORD DstAddr;
BYTE Options[0];
} IP;

typedef IP * LPIP;
typedef IP UNALIGNED * ULPIP;

//
// TCP Packet Structure
//
typedef struct _TCP
{
WORD SrcPort;
WORD DstPort;
DWORD SeqNum;
DWORD AckNum;
BYTE DataOff;
BYTE Flags;
WORD Window;
WORD Chksum;
WORD UrgPtr;
} TCP;

typedef TCP *LPTCP;
typedef TCP UNALIGNED * ULPTCP;

// upper protocols
#define PROTOCOL_STRING_ICMP_TXT "ICMP"
#define PROTOCOL_STRING_TCP_TXT "TCP"
#define PROTOCOL_STRING_UDP_TXT "UDP"
#define PROTOCOL_STRING_SPX_TXT "SPX"
#define PROTOCOL_STRING_NCP_TXT "NCP"

#define PROTOCOL_STRING_UNKNOW_TXT "UNKNOW"

Õâ¸öÎļþÒ²ÓÐÈËÉù³ÆûÓÐ.
//*************************************************************************//
//* Header file: mstcpip.h
//*************************************************************************//
// Copyright (c) Microsoft Corporation. All rights reserved.
#if _MSC_VER > 1000
#pragma once
#endif

/* Argument structure for SIO_KEEPALIVE_VALS */

struct tcp_keepalive {
u_long onoff;
u_long keepalivetime;
u_long keepaliveinterval;
};

// New WSAIoctl Options

#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#define SIO_RCVALL_MCAST _WSAIOW(IOC_VENDOR,2)
#define SIO_RCVALL_IGMPMCAST _WSAIOW(IOC_VENDOR,3)
#define SIO_KEEPALIVE_VALS _WSAIOW(IOC_VENDOR,4)
#define SIO_ABSORB_RTRALERT _WSAIOW(IOC_VENDOR,5)
#define SIO_UCAST_IF _WSAIOW(IOC_VENDOR,6)
#define SIO_LIMIT_BROADCASTS _WSAIOW(IOC_VENDOR,7)
#define SIO_INDEX_BIND _WSAIOW(IOC_VENDOR,8)
#define SIO_INDEX_MCASTIF _WSAIOW(IOC_VENDOR,9)
#define SIO_INDEX_ADD_MCAST _WSAIOW(IOC_VENDOR,10)
#define SIO_INDEX_DEL_MCAST _WSAIOW(IOC_VENDOR,11)

// Values for use with SIO_RCVALL* options
#define RCVALL_OFF 0
#define RCVALL_ON 1
#define RCVALL_SOCKETLEVELONLY 2

ÏÖÔÚÎÒÃÇ×ÔÒÑµÄ Sniffer ¾Í×öºÃÁË, Run, Start......ÍÛ, Õâô¶àÊý¾Ý°ü, ¶¼ÊÇ´ÓÕâһ̨»úÆ÷ÉÏ·¢³öµÄ, ËüÔÚ¸Éʲô? Ô­À´ Adminstrator ÃÜÂëΪ¿Õ, ÖÐÁËÄáÄ·´ï²¡¶¾!

Áù. С½á
Óŵã: ʵÏÖ¼òµ¥, ²»ÐèÒª×öÇý¶¯³ÌÐò¾Í¿ÉʵÏÖ×¥°ü.
ȱµã: Êý¾Ý°üÍ·²»º¬Ö¡ÐÅÏ¢, ²»ÄܽÓÊÕµ½Óë IP ͬ²ãµÄÆäËüÊý¾Ý°ü, Èç ARP, RARP...
ÕâÀïÌṩµÄ³ÌÐò½ö½öÊÇÒ»¸ö Sniffer µÄÀý×Ó, ûÓжÔÊý¾Ý°ü½øÐнøÒ»²½µÄ·ÖÎö. д´ËÎĵÄÄ¿µÄÔÚÓÚÊìϤRaw Socket ±à³Ì·½·¨, Á˽â TCP/IP ЭÒé½á¹¹Ô­ÀíÒÔ¼°¸÷ЭÒéÖ®¼äµÄ¹Øϵ.