有监视网卡数据流的开源软件吗？

[hamzsy]

我要监视通过网卡的数据流，并分析，根据数据类型做一定的统计，有这样的相关开源软件吗？

[dataat]

呵呵，我不知道你说的是否是sniffer软件，这种软件是比较多的。
你可以上网搜索一下，另外，如果相关的软件不是很符合要求的话，我建议你使用libpcap函数库自己来编写相关的抓包工具，很简单的。
祝你好运。

[dyhml]

Ethereal 有windows和linux版本 ,是基于libpcap的.

是gpl的.

[qizihuang]

iptable就可以实现

[IControlWorld]

tcpdump本身就有这个功能，tcpdump的原代码好找吧

[hamzsy]

先谢了，回去了好好看看

[bekars]

可以看看TC，这个是做流量控制的。

[hamzsy]

TC是啥,全称是什么?

[zengwh]

我一直都用ethreal，不过要装wincap，特别是用来分析协议。

[jjduan185]

sniffer不错，我自己也写了一个流量监视程序(很简单)，可以得到每个网卡的流速，不过原理很简单的，想看的话，Email我 [e-mail]

[bekars]

TC是Linux上流量控制的开源项目。

[jjduan185]

一个简单的程序，获得网卡列表及每个网卡的流量，大家参考！
#include <stdio.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/in.h>
#include <net/if_arp.h>
#include <arpa/inet.h>
#include <unistd.h> //for close()
#define BUFFERSIZE 20
#define MAXINTERFACES 16
struct netCardInfo
{
char Name[BUFFERSIZE];
unsigned int mode;// it is promisc or normal mode
unsigned int status; // up or down
char IP[BUFFERSIZE]; // ip address
char MacAdd[BUFFERSIZE];//mac address
unsigned int BytesRcv;//
unsigned int RytesTrans;//
unsigned int PackRcv;
unsigned int PackTrans;
};
int getNetList(struct netCardInfo a[]);
int getDDX(struct netCardInfo *);
int main(void)
{
int i,j;
while(1){
sleep(3);
struct netCardInfo netcards[MAXINTERFACES];
i = getNetList(netcards);
for(j = 0; j<i;j++)
{
printf("NAME : %s\n",netcards[j].Name);
printf("MODE : %d\n",netcards[j].mode);
printf("STATUS :%d\n",netcards[j].status);
printf("IP : %s\n",netcards[j].IP);
printf("MAC : %s\n",netcards[j].MacAdd);
if(getDDX(&netcards[j])==0)
printf("BYTES RCV %u\nBYTES TRANS %u\nPACKET RECV %u\nPACKET TRANS %u\n",
netcards[j].BytesRcv,netcards[j].RytesTrans,\
netcards[j].PackRcv,netcards[j].PackTrans);
printf("********************************************\n");
}
}
exit(0);
}
int get(struct netCardInfo a[])
{
int fd, intrface,i = 0, num = 0,retn = 0;
struct ifreq buf[MAXINTERFACES];
struct arpreq arp;
struct ifconf ifc;

if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) >= 0)
{
ifc.ifc_len = sizeof(buf);
ifc.ifc_buf = (caddr_t) buf;
if (!ioctl(fd, SIOCGIFCONF, (char *) &ifc))
{
intrface = ifc.ifc_len / sizeof(struct ifreq);
//printf("interface num is intrface=%d\n\n\n", intrface);
num = intrface;
while (intrface-- > 0)
{
//printf("net device %s\n", buf[intrface].ifr_name);
memset(a[i].Name,0,sizeof(a[i].Name));
sprintf( a[i].Name,"%s",buf[intrface].ifr_name);
/*Jugde whether the net card status is promisc */
if (!(ioctl(fd, SIOCGIFFLAGS, (char *) &buf[intrface])))
{
if (buf[intrface].ifr_flags & IFF_PROMISC)
{
//puts("the interface is PROMISC");
a[i].mode =1;
//retn++;
} else a[i].mode = 0;

}
else
{
//char str[256];

//sprintf(str, "cpm: ioctl device %s",
// buf[intrface].ifr_name);
a[i].mode = 0;
//perror(str);
}

/*Jugde whether the net card status is up */
if (buf[intrface].ifr_flags & IFF_UP)
{
//puts("the interface status is UP");
a[i].status = 1;
}
else
{
//puts("the interface status is DOWN");
a[i].status = 0;
}

/*Get IP of the net card */
if (!(ioctl(fd, SIOCGIFADDR, (char *) &buf[intrface])))
{
//puts("IP address is:");
/*puts(inet_ntoa(((struct sockaddr_in *)
(&buf[intrface].ifr_addr))->sin_addr));
*/
//puts("");
//puts (buf[intrface].ifr_addr.sa_data);
memset(a[i].IP,0,sizeof(a[i].IP));
sprintf(a[i].IP,"%s",inet_ntoa(((struct sockaddr_in *)
(&buf[intrface].ifr_addr))->sin_addr));
}
else
{
/*char str[256];

sprintf(str, "cpm: ioctl device %s",
buf[intrface].ifr_name);

perror(str);*/
memset(a[i].IP,0,sizeof(a[i].IP));
sprintf(a[i].IP,"%s","0.0.0.0");
}


/*Get HW ADDRESS of the net card */
memset(a[i].MacAdd,0,sizeof(a[i].MacAdd));
if (!(ioctl(fd, SIOCGIFHWADDR, (char *) &buf[intrface])))
{ //puts("HW address is:");
sprintf(a[i].MacAdd,"%02x:%02x:%02x:%02x:%02x:%02x",\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[0],\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[1],\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[2],\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[3],\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[4],\
(unsigned char) buf[intrface].ifr_hwaddr.sa_data[5]);
}
else
{
/*char str[256];
sprintf(str, "cpm: ioctl device %s",\
buf[intrface].ifr_name);
perror(str);*/
sprintf(a[i].MacAdd,"%s","00:00:00:00:00:00");
}
i++;
}
}
else return -1;
}
else return -1;
close(fd);
return i;
}
int getDDX(struct netCardInfo * netcard)
{
char text[201];
char data[201];
FILE *fp;
char seps[] = " ,\t";
char *token;
int i;
char net[20];
fp = fopen("/proc/net/dev", "r");
if(!fp) return -1;
memset(text,0,201);
while (fgets(text, 200, fp))
{
memset(net,0,20);
strcat(net,netcard->Name);
strcat(net,":\0");
token = strtok( text, seps );
memset(data,0,201);
if(strcmp(token,net)==0)
{
token = strtok( NULL, seps );
if(token == NULL) return -1;
strcat(data,token);
strcat(data," ");
token = strtok( NULL, seps );
if(token == NULL) return -1;
strcat(data,token);
for(i=0;i<6;i++)
{
token = strtok(NULL,seps);
if(token == NULL) return -1;
}
strcat(data," ");
token = strtok( NULL, seps );
if(token == NULL) return -1;
strcat(data,token);
strcat(data," ");
token = strtok( NULL, seps );
if(token == NULL) return -1;
strcat(data,token);
sscanf(data,"%u%u%u%u",&(netcard->BytesRcv),&(netcard->PackRcv),\
&(netcard->RytesTrans),&(netcard->PackTrans));
}
memset(text,0,201);
}
fclose(fp);
return 0;
}

[jjduan185]

呵呵，第二个函数写的比较繁琐，其实原理很简单，就是读proc目录底下的文件，获得跟ifconfig一样的结果，没有注视，不好意思！

[fisheryj]

我研究一下 看能不能编译通国