请教下网卡混杂模式

void_main_void 2016-08-28 10:57:26

我目前正在重造轮子，仿照SRSniffer写一个指定进程的嗅探工具。

程序基本已经写好，但是我对比SRSniffer的使用感觉在嗅探中明显没有它好用。很直观的就是SRSniffer我指定进程能抓到firefox浏览器的包。但是我的我的却抓不到。而且感觉我抓包明显感觉和SRSniffer有差距。。

我对此不知道是我的实现方式还是SRSniffer有特殊的姿势？我想来求证一下。。。



DWORD WINAPI CMainFrame::MonitorThread(LPVOID lParam)

{ 

    int nRecvSize = 0; 



    // 取得窗体指针

    CMainFrame* pDlg = (CMainFrame*)lParam;



    // 获取本地地址信息

    sockaddr_in LocalAddr;

    char szLocalName[DEF_BUF_SIZE] = { 0 };

    gethostname(szLocalName, DEF_BUF_SIZE);

    hostent* pHost = gethostbyname(szLocalName);

    if (pHost != NULL)

    {

        LocalAddr.sin_family = AF_INET;

        LocalAddr.sin_port = htons(6000);

        memcpy(&(LocalAddr.sin_addr.s_addr), pHost->h_addr_list[0], pHost->h_length);

    }

    else

    {

        return 0;

    } 



    // 创建监听套接字

    SOCKET MonSock = ::socket(AF_INET, SOCK_RAW, IPPROTO_IP);

    if (MonSock == INVALID_SOCKET)

    {

        return 0;

    } 



    BOOL status = TRUE;

    ::setsockopt(MonSock, SOL_SOCKET, SO_BROADCAST, (const char*)&status, sizeof(BOOL));

     

    // 绑定地址信息到套接字

    if (::bind(MonSock, (sockaddr*)&LocalAddr, sizeof(sockaddr)) == SOCKET_ERROR)

    {

        return 0;

    }



    DWORD dwBufferLen[10];

    DWORD dwBufferInLen = 1;

    DWORD dwBytesReturned = 0;



    DWORD data = SIO_RCVALL;



    if (::WSAIoctl(

            MonSock,

            data,

            &dwBufferInLen,

            sizeof(dwBufferInLen),

            &dwBufferLen,

            sizeof(dwBufferLen),

            &dwBytesReturned,

            NULL,

            NULL) != 0)

    {

        return 0;

    }

      

    // 设置为混杂模式，收所有IP包

    DWORD dwValue = 1;

    if (::ioctlsocket(MonSock, SIO_RCVALL, &dwValue) != 0)

    {

        return 0;

    }

     

    char szPackBuf[DEF_BUF_SIZE] = { 0 };

    tagIPHead* ipHead = (tagIPHead*)szPackBuf;

    tagTCPHead* tcpHead = (tagTCPHead*)(szPackBuf + sizeof(tagIPHead));

    tagUDPHead* udpHead = (tagUDPHead*)(szPackBuf + sizeof(tagIPHead));



    // 检测控制标志，是否继续监视

    while (pDlg->m_start)

    { 

        // 取得数据包

        nRecvSize = recv(MonSock, szPackBuf, DEF_BUF_SIZE, 0);

        if (nRecvSize <= 0)

        {

             continue;

        }

         

        // 只检测TCP和UDP包

        switch (ipHead->ip_p)

        {

        case IPPROTO_TCP:

            { 

                pDlg->addTCPPack(ipHead, tcpHead); 

                break;

            } 

        case IPPROTO_UDP:

            { 

                pDlg->addUDPPack(ipHead, udpHead);

                break;

            } 

        } 



        //::Sleep(100);

    }



    return 0;

}