解析IP数据包- 有源代码

[zhuangbx220]

Public Const AF_INET = 2
Public Const SOCK_RAW = 3
Public Const IPPROTO_IP = 0
Public Const IPPROTO_TCP = 6
Public Const IPPROTO_UDP = 17
Public Const SOCKET_ERROR = -1&
Public Const WSANOERROR = 0&
Public Const INVALID_SOCKET = 0&

Public Const MAX_PACK_LEN = 65535
Public Const MAX_ADDR_LEN = 16 ' The dotted addres's length.
Public Const MAX_PROTO_TEXT_LEN = 16 ' The length of sub protocol name(like "TCP").
Public Const MAX_PROTO_NUM = 12 ' The count of sub protocols.
Public Const MAX_HOSTNAME_LAN = 256 ' The max length of the host name.

Public Const IP_SUCCESS As Long = 0
Public Const MAX_WSADescription As Long = 256
Public Const MAX_WSASUSStatus As Long = 128
Public Const ERROR_SUCCESS = 0
Public Const WS_VERSION_REQD = &H101
Public Const WS_VERSION_MAJOR = WS_VERSION_REQD \ &H100 And &HFF&
Public Const WS_VERSION_MINOR = WS_VERSION_REQD And &HFF&
Public Const MIN_SOCKETS_REQD = 1

[zhuangbx220]

'// The IP packet is like this. Took from RFC791.
' 0 1 2 3
' 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' |Version| IHL |Type of Service| Total Length |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Identification |Flags| Fragment Offset |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Time to Live | Protocol | Header Checksum |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Source Address |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Destination Address |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Options | Padding |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
'*/

Type IPHeader ' 20 Bytes
lenver As Byte
Tos As Byte
len As Integer
ident As Integer
Flags As Integer
Ttl As Byte
proto As Byte
checksum As Integer
sourceIP As Long
destIP As Long
End Type
'-------------------------------------------------------------------------------------

'// The TCP packet is like this. Took from RFC793.
' 0 1 2 3
' 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Source Port | Destination Port |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Sequence Number |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Acknowledgment Number |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Data | |U|A|P|R|S|F| |
' | Offset| Reserved |R|C|S|S|Y|I| Window |
' | | |G|K|H|T|N|N| |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Checksum | Urgent Pointer |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | Options | Padding |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' | data |
' +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
'*/
Type TCPHEADER ' 20 Bytes
th_sport As Integer
th_dport As Integer
th_seq As Long
th_ack As Long
th_lenres As Byte
th_flag As Byte
th_win As Integer
th_sum As Integer
th_urp As Integer
End Type 'TCP_HEADER as long
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

'// The TCP's pseudo header is like this. Took from RFC793.
' +--------+--------+--------+--------+
' | Source Address |
' +--------+--------+--------+--------+
' | Destination Address |
' +--------+--------+--------+--------+
' | zero | PTCL | TCP Length |
' +--------+--------+--------+--------+
'*/
Type PSD_HEADER ' 16 Bytes
saddr As Long
daddr As Long
mbz As Byte
ptcl As Byte
tcpl As Integer
End Type 'PSD_HEADER as long
'-------------------------------------------------------------------

'// The UDP packet is lick this. Took from RFC768.
' 0 7 8 15 16 23 24 31
' +--------+--------+--------+--------+
' | Source | Destination |
' | Port | Port |
' +--------+--------+--------+--------+
' | | |
' | Length | Checksum |
' +--------+--------+--------+--------+
' |
' | data octets ...
' +---------------- ...
'*/
Type UDPHEADER ' 8 Bytes
uh_sport As Integer
uh_dport As Integer
uh_len As Integer
uh_sum As Integer
End Type ' UDP_HEADER as long

Type ICMPHEADER
i_type As Long
i_code As Long
i_cksum As Integer
i_id As Integer
i_seq As Integer
timestamp As Long
End Type 'ICMP_HEADER as long

Type ICMP_OPTIONS
Ttl As Byte
Tos As Byte
Flags As Byte
OptionsSize As Byte
OptionsData As Long
End Type

Public Type ICMP_ECHO_REPLY
Address As Long
status As Long
RoundTripTime As Long
DataSize As Long '注释：formerlyinteger
'注释：Reserved As Integer
DataPointer As Long
Options As ICMP_OPTIONS
Data As String * 250
End Type

' The protocol's map.
Type PROTOMAP
ProtoNum As Long
ProtoText(MAX_PROTO_TEXT_LEN) As Byte
End Type 'PROTOMAP as long

'static PROTOMAP ProtoMap[MAX_PROTO_NUM]=
'
' IPPROTO_IP , "IP " end type ',
' IPPROTO_ICMP , "ICMP" end type ',
' IPPROTO_IGMP , "IGMP" end type ',
' IPPROTO_GGP , "GGP " end type ',
' IPPROTO_TCP , "TCP " end type ',
' IPPROTO_PUP , "PUP " end type ',
' IPPROTO_UDP , "UDP " end type ',
' IPPROTO_IDP , "IDP " end type ',
' IPPROTO_ND , "NP " end type ',
' IPPROTO_RAW , "RAW " end type ',
' IPPROTO_MAX , "MAX " end type ',
' NULL , "" end type '
'End Type ' as long

[zhuangbx220]

Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal length As Long)

Function HexIp2DotIp(ByVal ip As Long) As String
Dim s As String, p1 As String, p2 As String, p3 As String, p4 As String
s = Right("00000000" & Hex(ip), 8)
p1 = Val("&h" & Mid(s, 1, 2))
p2 = Val("&h" & Mid(s, 3, 2))
p3 = Val("&h" & Mid(s, 5, 2))
p4 = Val("&h" & Mid(s, 7, 2))
HexIp2DotIp = p4 & "." & p3 & "." & p2 & "." & p1
End Function

Function hibyte(ByVal wParam As Integer) '提取整形数据的高位字节

hibyte = wParam \ &H100 And &HFF&

End Function

Function lobyte(ByVal wParam As Integer) '提取整形数据的低位字节

lobyte = wParam And &HFF&

End Function

[zhuangbx220]

Private Sub Command1_Click()
Dim IPH As IPHeader, TCPH As TCPHEADER
Dim mem() As Byte
Dim FN As String, f As Integer, i As Long
i = 1
'For i = 1 To 100
f = FreeFile

FN = "D:\My Documents\IP-DATA\TCP_" & i & ".DAT"
Open FN For Binary As f
ReDim mem(LOF(f) - 1)
Get #f, , mem
Close f

CopyMemory IPH, mem(0), Len(IPH)

With IPH
Debug.Print .sourceIP, HexIp2DotIp(.sourceIP), "源地址"
Debug.Print .destIP, HexIp2DotIp(.destIP), "目标地址"
Debug.Print
'DoEvents

End With

End Sub

[Keng]

我来了。.帮你顶哈.

[zhuangbx220]

谁能把其它的数据解析出来啊？

发到我的邮箱吧。

[e-mail]

QQ:57490455

[luler]

:P

[zhuangbx220]

up

[koma2003]

UP

[Alicky]

up

[cooling]

我开发了一个手机与计算机通信的软件(自定义数据格式、文本格式),已经应用于实际产品中--远程电表抄表.delphi和c实现的源代码都有.
如果有意要源码的(发现有很多同行都在找这样的资料),请跟我联系.

qq: 21156410
email: [e-mail]
手机: [phone](只收短信)

不过这两天都不大上网