如何截获数据包？

[yulei0707]

如何截获本机某个端口的数据包？？？？？
举个例子！！！

[柯本]

我只有VC的,有空可以改成d的
http://topic.csdn.net/t/20050422/12/3958116.html

[yulei0707]

讲一下整个思路吧

[do2008]

http://topic.csdn.net/t/20050307/07/3829318.html

http://www.tomore.com/dispdocnew.php?id=29305

[yulei0707]

top

[股神]

up

[zuoansuifeng]

unit UnCYCap_ip;

interface

uses
Windows, Messages, Classes, winsock, sysutils;
const
WM_CapIp = WM_USER + 200;

STATUS_FAILED = $FFFF; //定义异常出错代码
MAX_PACK_LEN = 65535; //接收的最大IP报文
MAX_ADDR_LEN = 16; //点分十进制地址的最大长度
MAX_PROTO_TEXT_LEN = 16; //子协议名称(如"TCP")最大长度
MAX_PROTO_NUM = 12; //子协议数量
MAX_HOSTNAME_LAN = 255; //最大主机名长度
CMD_PARAM_HELP = True;

IOC_IN = $80000000;
IOC_VENDOR = $18000000;
IOC_out = $40000000;
SIO_RCVALL = IOC_IN or IOC_VENDOR or 1; // or IOC_out;
SIO_RCVALL_MCAST = IOC_IN or IOC_VENDOR or 2;
SIO_RCVALL_IGMPMCAST = IOC_IN or IOC_VENDOR or 3;
SIO_KEEPALIVE_VALS = IOC_IN or IOC_VENDOR or 4;
SIO_ABSORB_RTRALERT = IOC_IN or IOC_VENDOR or 5;
SIO_UCAST_IF = IOC_IN or IOC_VENDOR or 6;
SIO_LIMIT_BROADCASTS = IOC_IN or IOC_VENDOR or 7;
SIO_INDEX_BIND = IOC_IN or IOC_VENDOR or 8;
SIO_INDEX_MCASTIF = IOC_IN or IOC_VENDOR or 9;
SIO_INDEX_ADD_MCAST = IOC_IN or IOC_VENDOR or 10;
SIO_INDEX_DEL_MCAST = IOC_IN or IOC_VENDOR or 11;


type
tcp_keepalive = record
onoff: Longword;
keepalivetime: Longword;
keepaliveinterval: Longword;
end;

// New WSAIoctl Options

[zuoansuifeng]

//IP头
type
_iphdr = record
h_lenver : byte; //4位首部长度+4位IP版本号
tos : char; //8位服务类型TOS
total_len : char; //16位总长度（字节）
ident : word; //16位标识
frag_and_flags : word; //3位标志位/13位偏移量
ttl : byte; //8位生存时间 TTL
proto : byte; //8位协议 (TCP, UDP 或其他)
checksum : word; //16位IP首部校验和
sourceIP : Longword; //32位源IP地址
destIP : Longword; //32位目的IP地址
end;
IP_HEADER = _iphdr;

type
_tcphdr = record //定义TCP首部
TCP_SPort : word; //16位源端口
TCP_DPort : word; //16位目的端口
th_seq : longword; //32位序列号
th_ack : longword; //32位确认号
th_lenres : byte; //4位首部长度/6位保留字
th_flag : byte; //6位标志位
th_win : word; //16位窗口大小
th_sum : word; //16位校验和
th_urp : word; //16位紧急数据偏移量
end;
TCP_HEADER = _tcphdr;

type
_udphdr = record //定义UDP首部
uh_sport : word; //16位源端口
uh_dport : word; //16位目的端口
uh_len : word; //16位长度
uh_sum : word; //16位校验和
end;
UDP_HEADER = _udphdr;

type
_icmphdr = record //定义ICMP首部
i_type : byte; //8位类型
i_code : byte; //8位代码
i_cksum : word; //16位校验和
i_id : word; //识别号（一般用进程号作为识别号）
//i_seq : word; //报文序列号
timestamp : word; //时间戳
end;
ICMP_HEADER = _icmphdr;

type
_protomap = record //定义子协议映射表
ProtoNum : integer;
ProtoText : array[0..MAX_PROTO_TEXT_LEN] of char;
end;
TPROTOMAP = _protomap;

[zuoansuifeng]

type
ESocketException = class(Exception);
TWSAStartup = function (wVersionRequired: word;
var WSData: TWSAData): Integer; stdcall;
TOpenSocket = function (af, Struct, protocol: Integer): TSocket; stdcall;
TInet_addr = function (cp: PChar): u_long; stdcall;
Thtons = function (hostshort: u_short): u_short; stdcall;
TConnect = function (s: TSocket; var name: TSockAddr;
namelen: Integer): Integer; stdcall;
TWSAIoctl = function (s: TSocket; cmd: DWORD;lpInBuffer: PCHAR;
dwInBufferLen: DWORD;lpOutBuffer: PCHAR; dwOutBufferLen: DWORD;
lpdwOutBytesReturned: LPDWORD;lpOverLapped: POINTER;
lpOverLappedRoutine: POINTER): Integer; stdcall;
TCloseSocket = function (s: TSocket): Integer; stdcall;
Tsend = function (s: TSOCKET; buf: pchar;Len: integer;flags: integer): Integer; stdcall;
Trecv = function (s: TSOCKET; var buf;Len: integer;flags: integer):Integer; stdcall;
TWSAAsyncSelect = function (s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall;
TWSACleanup = function (): integer; stdcall;
TOnCap = procedure(ip, proto, sourceIP, destIP, SourcePort, DestPort: string;
header: pchar; header_size: integer; data: pchar; data_size: integer; IPHeader: IP_HEADER; TCPHeader: TCP_HEADER) of object;
TOnError = procedure(Error: string) of object;

TCYCap_ip = class(TComponent)
private
Fhand_dll :HModule; // Handle for mpr.dll
FWindowHandle : HWND;
FOnCap :TOnCap; //捕捉数据的事件
FOnError :TOnError; //发生错误的事件
Fsocket :array of Tsocket;
FActiveIP :array of string;//存放可用的IP

FWSAStartup : TWSAStartup;
FOpenSocket : TOpenSocket;
FInet_addr : TInet_addr;
Fhtons : Thtons;
FConnect : TConnect;
FCloseSocket : TCloseSocket;
Fsend :Tsend;
FWSAIoctl :TWSAIoctl;
Frecv :Trecv;
FWSACleanup :TWSACleanup;
FWSAAsyncSelect :TWSAAsyncSelect;

protected
procedure WndProc(var MsgRec: TMessage);
function DecodeIpPack(ip:string;buf:pchar;iBufSize:integer):integer; //IP解包函数
// function DecodeTcpPack(TcpBuf:pchar;iBufSize:integer):integer; //TCP解包函数
//function DecodeUdpPack(p:pchar;i:integer):integer; //UDP解包函数
//function DecodeIcmpPack(p:pchar;i:integer):integer; //ICMP解包函数
function CheckProtocol(iProtocol:integer):string; //协议检查
procedure cap_ip(socket_no:integer);
procedure get_ActiveIP; //得当前的IP列表
procedure set_socket_state; //设置网卡状态
function CheckSockError(iErrorCode:integer):boolean; //出错处理函数
public
Fpause :boolean; //暂停
Finitsocket :boolean; //是否已初始化
constructor Create(Owner : TComponent); override;
destructor Destroy; override;
function init_socket: boolean; //初始化
procedure StartCap; //开始捕捉
procedure pause; //暂停
procedure StopCap; //结束捕捉
property Handle : HWND read FWindowHandle;
published
property OnCap : TOnCap read FOnCap write FOnCap;
property OnError : TOnError read FOnError write FOnError;
end;

{
TMsgThread = class(TThread)
private
protected
procedure Execute; override;
public
end;
}

[fox1999]

楼上的例子比较好