C++ Sniffer类代码示例

void* capEngineThread(void *arg)
{
    if(v)cout << "Capture Engine started " << endl;
    Sniffer *snf = (Sniffer *)arg;
    snf->readPackets(processPacket, (u_char *)arg);
    if(v)cout << "Capture Engine stopped " << endl;
    return 0;
}

void *thread_proc(void *param) {
    // IP address is our parameter.
    sniffer_data *data = (sniffer_data*)param;
    Sniffer *sniffer = data->first;
    sniffer->set_filter("tcp and ip src " + data->second + " and tcp[tcpflags] & (tcp-rst|tcp-syn) != 0");
    // Sniff loop. Only sniff TCP PDUs comming from the given IP and have either RST or SYN flag on.
    sniffer->sniff_loop(handler);
    return 0;
}

void SnifferConfiguration::configure_sniffer_post_activation(Sniffer& sniffer) const
{
    if ((_flags & PACKET_FILTER) != 0) {
        if (!sniffer.set_filter(_filter)) {
            throw std::runtime_error("Could not set the filter! ");
        }
    }
    if (!sniffer.set_direction(_direction)) {
        throw std::runtime_error("Could not set the direction! ");
    }
}

int main(int argc, char *argv[])
{
	Sniffer snfr;

	snfr.startCapturing();
	while(1)
	{
		cout<<"Packet Count : "<<PacketList::packetList.size()<<endl;
		sleep(1);
	}

	return 0;
}

void SnifferConfiguration::configure_sniffer_post_activation(Sniffer& sniffer) const {
    if ((flags_ & PACKET_FILTER) != 0) {
        if (!sniffer.set_filter(filter_)) {
            throw invalid_pcap_filter(pcap_geterr(sniffer.get_pcap_handle()));
        }
    }
    // TODO: see how to actually do this on winpcap
    #ifndef _WIN32
    if ((flags_ & DIRECTION) != 0) {
        if (!sniffer.set_direction(direction_)) {
            throw pcap_error(pcap_geterr(sniffer.get_pcap_handle()));
        }
    }
    #endif // _WIN32
}

void arp_monitor::run(Sniffer& sniffer) {
    sniffer.sniff_loop(
        bind(
            &arp_monitor::callback,
            this,
            std::placeholders::_1
        )
    );
}

void SnifferConfiguration::configure_sniffer_pre_activation(Sniffer& sniffer) const {
    sniffer.set_snap_len(snap_len_);
    sniffer.set_timeout(timeout_);
    if ((flags_ & BUFFER_SIZE) != 0) {
        sniffer.set_buffer_size(buffer_size_);
    }
    if ((flags_ & PROMISCUOUS) != 0) {
        sniffer.set_promisc_mode(promisc_);
    }
    if ((flags_ & RFMON) != 0) {
        sniffer.set_rfmon(rfmon_);
    }
    if ((flags_ & IMMEDIATE_MODE) != 0) {
        sniffer.set_immediate_mode(immediate_mode_);
    }
}

void SnifferConfiguration::configure_sniffer_pre_activation(Sniffer& sniffer) const
{
    sniffer.set_snap_len(_snap_len);
    sniffer.set_timeout(_timeout);

    if ((_flags & BUFFER_SIZE) != 0) {
        sniffer.set_buffer_size(_buffer_size);
    }
    if ((_flags & PROMISCUOUS) != 0) {
        sniffer.set_promisc_mode(_promisc);
    }
    if ((_flags & RFMON) != 0) {
        sniffer.set_rfmon(_rfmon);
    }
    if ((_flags & IMMEDIATE_MODE) != 0) {
        sniffer.set_immediate_mode(_immediate_mode);
    }
}

extern "C" DLL_EXPORT void AddDestinationIP(std::string NewIP)
{
    RSSniffer.AddDestinationIP(NewIP);
}

void processPacket(u_char *args, const struct pcap_pkthdr* pkthdr, const u_char* packet)
{
    Sniffer *snf = (Sniffer *)args;
    map<string, ConnInfo>::iterator it;

    u_long dstIp = snf->getDstIpRaw(packet);
    int dstPort = snf->getTcpDstPort(packet);

    if(snf->isRst(packet)) {
        if(v)cout << "Got RST-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
    } else if(snf->isFin(packet)) {
        if(v)cout << "Got FIN-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
        pthread_mutex_lock(&connMutex);
        it = connsEstab.find(connId(dstIp, dstPort));
        if(it != connsEstab.end()) { 	// we received FIN for an established TCP connection
            connsEstab.erase(it);		// delete the established connections
            pthread_mutex_unlock(&connMutex);
            pthread_mutex_lock(&countMutex);
            (*snf->finNo)++;			// increase number of finished connections
            pthread_mutex_unlock(&countMutex);
        } else {
            pthread_mutex_unlock(&connMutex);
        }
    } else {
        if(v)cout << "Got SYN-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
    }

    pthread_mutex_lock(&connMutex);
    it = connsInited.find(connId(dstIp, dstPort));
    if(it != connsInited.end()) {
        if(v)cout << "Found session " << endl;
        connsInited.erase(it);
        pthread_mutex_unlock(&connMutex);

        if(snf->isRst(packet)) {
            pthread_mutex_lock(&countMutex);
            (*snf->rstNo)++;
            pthread_mutex_unlock(&countMutex);
            return;
        } else if(snf->isFin(packet)) {
            pthread_mutex_lock(&countMutex);
            (*snf->finNo)++;
            pthread_mutex_unlock(&countMutex);
            return;
        }

        Pkt pkt; //This is the ACK packet that we send
        pkt.srcIp = snf->getDstIpRaw(packet);
        pkt.dstIp = snf->getSrcIpRaw(packet);
        pkt.srcPort = snf->getTcpDstPort(packet);
        pkt.dstPort = snf->getTcpSrcPort(packet);
        pkt.seqn = snf->getTcpACK(packet);
        pkt.ackn = snf->getTcpSEQ(packet) + 1;

        pthread_mutex_lock(&ackMutex);
        pktsToSend.push_back(pkt);			//ACKs will be sent from this queue (to complete 3-way handshake)
        pthread_mutex_unlock(&ackMutex);
    } else {
        pthread_mutex_unlock(&connMutex);
    }
}

extern "C" DLL_EXPORT int GetInterface()
{
    return RSSniffer.GetInterface();
}

extern "C" DLL_EXPORT bool Initialize()
{
    return RSSniffer.Initialize();
}

extern "C" DLL_EXPORT void SetInterface(int Interf)
{
    RSSniffer.SetInterface(Interf);
}

extern "C" DLL_EXPORT void ListenSource(bool Listen)
{
    RSSniffer.ListenSource(Listen);
}

extern "C" DLL_EXPORT void ListenDestination(bool Listen)
{
    RSSniffer.ListenDestination(Listen);
}