什么工具能捕获IP、UDP数据包的内容

[dimcat]

什么工具能捕获IP、UDP数据包的内容?

[ksyou]

windump可以
给分

[fat_horse]

很多很多.....
在win*下有：netxray
在lin*下有：tcpdump
在www.google.com上搜一下吧。

[starcom13]

iris ,,ethereal, window2000下也有
and so on

[peral]

win2k下自己写一个sniffer太容易了,给你一段代码稍微改一下就OK
void main(int argc, char ** argv)
{
int iErrorCode;
WSADATA wsaData;
char RecvBuf[MAX_PACK_LEN] = {0};

//初始化SOCKET

iErrorCode = WSAStartup(MAKEWORD(2,1),&wsaData);
CheckSockError(iErrorCode, "WSAStartup");
SockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);
CheckSockError(SockRaw, "socket");

//获取本机IP地址
char FAR name[MAX_HOSTNAME_LAN];
iErrorCode = gethostname(name, MAX_HOSTNAME_LAN);
CheckSockError(iErrorCode, "gethostname");
struct hostent FAR * pHostent;
pHostent = (struct hostent * )malloc(sizeof(struct hostent));
pHostent = gethostbyname(name);

SOCKADDR_IN sa;
sa.sin_family = AF_INET;
sa.sin_port = htons(5052);
memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);
iErrorCode = bind(SockRaw, (PSOCKADDR)&sa, sizeof(sa));
CheckSockError(iErrorCode, "bind");

//设置SOCK_RAW为SIO_RCVALL，以便接收所有的IP包
DWORD dwBufferLen[10] ;
DWORD dwBufferInLen = 1 ;
DWORD dwBytesReturned = 0 ;

iErrorCode=WSAIoctl(SockRaw, SIO_RCVALL,&dwBufferInLen, sizeof(dwBufferInLen),
&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );
CheckSockError(iErrorCode, "Ioctl");

//侦听IP报文
int count = 0;
while(1)
{
memset(RecvBuf, 0, sizeof(RecvBuf));
iErrorCode = recv(SockRaw, RecvBuf, sizeof(RecvBuf), 0);
CheckSockError(iErrorCode, "recv");
count++;
// printf("%d->",count);
iErrorCode = DecodeIpPack(RecvBuf, iErrorCode);
CheckSockError(iErrorCode, "Decode");
}
}

//IP解包程序
int DecodeIpPack(char *buf, int iBufSize)
{
IP_HEADER *pIpheader;
int iProtocol, iTTL;
char szProtocol[MAX_PROTO_TEXT_LEN];
char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];
SOCKADDR_IN saSource, saDest;
pIpheader = (IP_HEADER *)buf;

//Check Proto
iProtocol = pIpheader->proto;
strncpy(szProtocol, CheckProtocol(iProtocol), MAX_PROTO_TEXT_LEN);
if((iProtocol==IPPROTO_TCP) && (!ParamTcp)) return TRUE;
if((iProtocol==IPPROTO_UDP) && (!ParamUdp)) return TRUE;
if((iProtocol==IPPROTO_ICMP) && (!ParamIcmp)) return TRUE;

//Check Source IP
saSource.sin_addr.s_addr = pIpheader->sourceIP;
strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);
if (strFromIpFilter) {
if (strcmp(strFromIpFilter,szSourceIP)) return TRUE;
}

//Check Dest IP
saDest.sin_addr.s_addr = pIpheader->destIP;
strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);

if (strDestIpFilter){
if (strcmp(strDestIpFilter,szDestIP)) return TRUE;
}
iTTL = pIpheader->ttl;

//Output
printf("%s ", szProtocol);
printf("%s->%s ", szSourceIP, szDestIP);
printf("bytes=%d TTL=%d ",iBufSize,iTTL);

//Calculate IP Header Length
int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);

//Decode Sub Protocol:TCP, UDP, ICMP, etc
switch(iProtocol) {
case IPPROTO_TCP :DecodeTcpPack(buf+iIphLen);break;
case IPPROTO_UDP :DecodeUdpPack(buf+iIphLen);break;
case IPPROTO_ICMP :DecodeIcmpPack(buf+iIphLen);break;
default :break;
}
//printf("\n");
return TRUE;
}

[jumbol]

sniffer

[idlest]

spynet

[dlpfei]

tumod

[taockey]

网络通天眼

[dimcat]

非常谢谢！