数据包分析

想要知道如何解析IP数据包，就要知道不同的IP数据包的包头结构，于是我们上⽹查查资料：

以太网数据包

ARP数据包

IPv4

IPv6

TCP

UDP

ICMP

ICMPv6

根据以上数据包头结构，我们就有了我们的protocol.h文件，声明各种数据包：

#ifndef PROTOCOL_H
#define PROTOCOL_H
#define HAVE_REMOTE
#define PROTO_ICMP 1
#define PROTO_TCP 6
#define PROTO_UDP 17
#include <iostream>
#include <QObject>
#include "_bsd_types.h"
#include "pcap.h"
using namespace std;
//IPV4
typedef struct ip_address{
    u_char byte1;
    u_char byte2;
    u_char byte3;
    u_char byte4;
}ip_address;

typedef struct ipv6_address
{
    u_char byte1;
    u_char byte2;
    u_char byte3;
    u_char byte4;
    u_char byte5;
    u_char byte6;
    u_char byte7;
    u_char byte8;
}ipv6_address;

typedef struct ipv4_header{
    u_char ver_ihl;
    u_char tos;
    u_short tlen;
    u_short Identification;
    u_short flags_fo;
    u_char ttl;
    u_char proto;
    u_short crc;
    ip_address srcaddr;
    ip_address dstaddr;
    u_int op_pad;
}ipv4_header;

typedef struct ipv6_header{
    u_int ver:4,
        flowtype:8,
        flowtip:20;
    u_short len;
    u_char pnext;
    u_char lim;
    ipv6_address srcaddr;
    ipv6_address dstaddr;
}ipv6_header;

typedef struct tcp_header{
    u_short srcport;
    u_short dstport;
    u_int seq;
    u_int ack_seq;
    u_short resl:4,
        doff:4,
        fin:1,
        syn:1,
        pst:1,
        psh:1,
        ack:1,
        urg:1,
        ece:1,
        cwr:1;
    u_short window;
    u_short check;
    u_short urg_ptr;
    u_int opt;
}tcp_header;

typedef struct udp_header{
    u_short srcport;
    u_short dstport;
    u_short tlen;
    u_short crc;
}udp_header;

typedef struct icmp_header{
    u_char type;
    u_char code;
    u_char seq;
    u_char crc;
}icmp_header;

typedef struct icmp6_header{
    u_char type;
    u_char code;
    u_char seq;
    u_char crc;
    u_char op_type;
    u_char op_len;
    u_char op_ethaddr[6];
}icmp6_header;

typedef struct pkg_count{
    int n_tcp;
    int n_udp;
    int n_icmp;
    int n_icmp6;
    int n_http;
    int n_arp;
    int n_ipv4;
    int n_ipv6;
    int n_other;
    int n_ttl;
}pkg_count;

typedef struct arp_header{
    u_short hardware;
    u_short proto;
    u_char ml;
    u_char ipl;
    u_short opt;
    u_char sm[6];
    ip_address sip;
    u_char dm[6];
    ip_address dip;
}arp_hearder;

typedef struct eth_header{
    u_char smac[6];
    u_char dmac[6];
    u_short type;
}eth_header;

typedef struct pkg_data
{
    QString pkgtype;
    int time[6];
    int len;
    
    eth_header *ethh;
    
    ipv4_header *ipv4h;
    ipv6_header *ipv6h;
    arp_header *arph;
    
    udp_header *udph;
    tcp_header *tcph;
    icmp_header *icmph;
    icmp6_header *icmp6;

    void *apph;
    
}pkg_data;




#endif // PROTOCOL_H

再对数据包的结构进行了解后，我们就需要对这些包进行解析，所以我们需要一个packettools类，里面用静态函数写出包的解析，供我们在别的地方调用：

#ifndef PACKETTOOLS_H
#define PACKETTOOLS_H
#include <QObject>
#include <QTextEdit>
#include "protocol.h"
#include "iostream"

using namespace std;

class PacketTools
{
public:
    static int unpcak_Frame(const u_char *pkg,
                             pkg_data *data,
                             pkg_count *pkgCnts);


    static int unpcak_Arp(const u_char *pkg,
                           pkg_data *data,
                           pkg_count *pkgCnts);

    static int unpack_Ip(const u_char *pkg,
                          pkg_data *data,
                          pkg_count *pkgCnts);

    static int unpack_Ipv6(const u_char *pkg,
                           pkg_data *data,
                           pkg_count *pkgCnts);

    static int unpack_Icmp(const u_char *pkg,
                            pkg_data *data,
                            pkg_count *pkgCnts);

    static int unpack_Icmp6(const u_char *pkg,
                            pkg_data *data,
                            pkg_count *pkgCnts);

    static int unpack_Tcp(const u_char *pkg,
                           pkg_data *data,
                           pkg_count *pkgCnts);

    static int unpack_Udp(const u_char *pkg,
                           pkg_data *data,
                           pkg_count *pkgCnts);

    static int pack_Print(u_char *pkg,
                           int size,
                          QTextEdit *edit);
};

#endif // PACKETTOOLS_H

主要一点就是要知道父类数据包的type字段对子类数据包的分类，然后将数据包拷贝储存到全局容器里面。