问题描述
如题，功能：1使用WinPCap的接口，实现一个网络嗅探器2完成截获数据包的功能、并具备分析数据包的功能。提供个源码啊!谢谢啦
解决方案
解决方案二：
没人会吗？
解决方案三：
我的毕业设计就是做这个企业信息安全防范系统还有代码哦
解决方案四：
是吗？我也是！帮忙发过来参考参考！lhn.luck@yahoo.com.cn不胜感激！谢谢！
解决方案五：
发了看看不知道合不合要求
解决方案六：
unitProtohdr;{PROTOHDR.PASOriginalsourceisPROTOHDR.HWrittenbySang-EunHan(seh@brabo1.korea.ac.kr,http://widecomm.korea.ac.kr/~seh).ConverttoDelphi4.0by:Jagad(don@indo.net.id)May10,1999:MakefasterTOULONGandTOUSHORTfunctionandmakeitworkswithD3by:FrancoisPiette(francois.piette@pophost.eunet.be)}{$ALIGNON}interfacetype//EthernetFrameHeader(*typedefstruct_ETHERNET_HDR{UCHARDestination[6];UCHARSource[6];UCHARProtocol[2];UCHARData[1];}ETHERNET_HDR,*PETHERNET_HDR;*)ETHERNET_HDR=packedrecordDestination:array[0..5]ofByte;Source:array[0..5]ofByte;Protocol:array[0..1]ofByte;Data:array[0..0]ofByte;end;PETHERNET_HDR=^ETHERNET_HDR;const//rfc1340PROTO_IP=$0800;PROTO_ARP=$0806;PROTO_XNS=$0600;PROTO_SNMP=$814C;PROTO_OLD_IPX=$8137;PROTO_NOVELL=$8138;PROTO_IPNG=$86DD;OFFSET_IP=14;type//IPv4Header(*typedefstruct_IP_RHDR{UCHARVerLen;UCHARService;UCHARLength[2];UCHARIdent[2];UCHARFlagoff[2];UCHARTimelive;UCHARProtocol;UCHARChecksum[2];UCHARSource[4];UCHARDestination[4];UCHARData[1];}IP_RHDR,*PIP_RHDR;*)IP_RHDR=packedrecordVerlen:Byte;Service:Byte;Length:array[0..1]ofByte;Ident:array[0..1]ofByte;Flagoff:array[0..1]ofByte;TimeLive:byte;Protocol:byte;Checksum:array[0..1]ofbyte;Source:array[0..3]ofbyte;Destination:array[0..3]ofbyte;Data:array[0..0]ofbyte;end;PIP_RHDR=^IP_RHDR;//IPv6Header(*typedefstruct_IPNG_RHDR{byteVerPrio;byteFlowLabel[3];byteLength[2];byteNextHdr;byteHopLimit;byteSource[16];byteDestination[16];byteData[1];}IPNG_RHDR,*PIPNG_RHDR;*)IPNG_RHDR=packedrecordVerPrio:byte;FlowLabel:array[0..2]ofbyte;Length:array[0..1]ofbyte;NextHadr:byte;HopLimit:byte;Source:array[0..15]ofbyte;Destination:array[0..15]ofbyte;Data:array[0..0]ofbyte;end;PIPNG_RHDR=^IPNG_RHDR;//TCPHeader,RFC793(*typedefstruct_TCP_RHDR{byteSource[2];byteDestination[2];byteSeq[4];byteAck[4];byteRsvd0:4;byteOffset:4;byteFlags:6;byteRsvd1:2;byteWindow[2];byteChecksum[2];byteUrgPoint[2];byteData[1];}TCP_RHDR,*PTCP_RHDR;*)TCP_RHDR=packedrecordSource:array[0..1]ofbyte;//SourcePortDestination:array[0..1]ofbyte;//DestinationPortSeq:array[0..3]ofbyte;Ack:array[0..3]ofbyte;Rsvd0_Off:byte;Flags_Rsvd1:byte;Window:array[0..1]ofbyte;Checksum:array[0..1]ofbyte;UrgPoint:array[0..1]ofbyte;Data:array[0..0]ofbyte;end;PTCP_RHDR=^TCP_RHDR;constTCP_FLAG_FIN=$01;TCP_FLAG_SYN=$02;TCP_FLAG_RST=$04;TCP_FLAG_PSH=$08;TCP_FLAG_ACK=$10;TCP_FLAG_URG=$20;PROTO_TCP=6;type//UDPHeader(*typedefstruct_UDP_RHDR{byteSource[2];byteDestination[2];byteLength[2];byteChecksum[2];byteData[1];}UDP_RHDR,*PUDP_RHDR;*)UDP_RHDR=packedrecordSource:array[0..1]ofbyte;Destination:array[0..1]ofbyte;Length:array[0..1]ofbyte;Checksum:array[0..1]ofbyte;Data:array[0..0]ofbyte;end;PUDP_RHDR=^UDP_RHDR;//PseudoHeaderforevaluatingTCP/UDPChecksum(*typedefstruct_PSU_RHDR{byteSource[4];byteDestination[4];byteZero;byteProtocol;byteLength[2];byteData[1];}PSU_RHDR,*PPSU_RHDR;*)PSU_RHDR=packedrecordSource:array[0..3]ofbyte;Destination:array[0..3]ofbyte;Zero:byte;Protocol:byte;Length:array[0..1]ofbyte;Data:array[0..0]ofbyte;end;PPSU_RHDR=^PSU_RHDR;//BorlandCBuilderis32bitWinApp//#ifdefWIN32//#defineTOUSHORT(x)(USmallint)(*(x)<<8|*(x+1))//#defineTOULONG(x)(ULONG)(*(x)<<24|*(x+1)<<16|*(x+2)<<8|*(x+3))//#else//#defineTOUSmallint(x)(*(USmallint*)x)//Big-Endian//#defineTOULONG(x)(*(ULONG*)x)//#endiffunctionTOUSmallint(x:PChar):Smallint;functionTOULONG(x:PChar):LongWord;implementationfunctionTOUSmallint(x:PChar):Smallint;beginResult:=(Smallint(x^)shl8)or(Smallint((x+1)^));//FPMay10,1999end;functionTOULONG(x:PChar):LongWord;beginResult:=(LONGWORD(x^)shl24)or//FPMay10,1999(LONGWORD((x+1)^)shl16)or//FPMay10,1999(LONGWORD((x+2)^)shl8)or//FPMay10,1999(LONGWORD((x+3)^));//FPMay10,1999end;end.
解决方案七：
{********************************************************************************--------------------------------------------------------------------------------TZNIFFERforPacketCaptureDriverbyPolitecnicodiTorinoWrittenbyLarsPeterChristiansen--------------------------------------------------------------------------------TERMSANDCONDITIONSOFUSE.AllofthissoftwareisCopyright(C)2002LarsPeterChristiansen.Theauthorofthissoftwareassumesnoliabilityfordamagescausedunderanycircumstanceswhatsoever,andisundernoobligation.Useofthesoftwareindicatesacceptanceofallconditionscontainedinthisdocument.Ifyoudonotagreetotheseterms,youmustdeletethissoftwareimmediately.Youmaydistributethearchiveinwhichthissoftwareisdistributed,butundernocircumstancesmustthisarchivebechanged.Distributingamodifiedarchiveisaviolationofthesoftwarelicense.Ifyoudoredistributethissoftware,pleaseletmeknowattheemailaddressgivenbelow.Ifyouhaveanyquestions,requests,bugreports,etc.,pleasecontactmeattheaddressgivenbelow.LarsPeterChristiansenEmail:lp@nzlab.dkWebsite:http://www.nzlab.dk--------------------------------------------------------------------------------[userapplication][TZniffer]<-youarehere![PCAP][Netadapter]********************************************************************************}unitZniffer;interfaceusesWindows,Classes,Sysutils,Pcap,Packet32;TypePETHERNET_HDR=^ETHERNET_HDR;ETHERNET_HDR=packedrecordDestination:array[0..5]ofUCHAR;Source:array[0..5]ofUCHAR;Protocol:array[0..1]ofUCHAR;Data:array[0..0]ofUCHAR;end;PIP_RHDR=^IP_RHDR;IP_RHDR=packedrecordVerlen:UCHAR;//4bitversion4bitlength(bytes/8)Service:UCHAR;//TOSLength:WORD;Ident:WORD;Flagoff:array[0..1]ofUCHAR;//3bitflag-13bitoffsetTimeLive:UCHAR;Protocol:UCHAR;Checksum:WORD;SrcIP:array[0..3]ofUCHAR;DestIP:array[0..3]ofUCHAR;Data:array[0..0]ofUCHAR;end;//Added(LarsPeterChristiansen13-04-2001)PTCP_RHDR=^TCP_RHDR;TCP_RHDR=PackedrecordSrcPort:WORD;DestPort:WORD;SequenceNr:array[0..3]ofUCHAR;AckNumber:array[0..3]ofUCHAR;LenResvFlags:array[0..1]ofUCHAR;//length(4bits)rsvd(6bits)flags(6bits)WindowSize:array[0..1]ofUCHAR;Checksum:array[0..1]ofUCHAR;UrgentPtr:array[0..1]ofUCHAR;Data:array[0..0]ofUCHAR;end;Tzniffer=class;//ThreadthatlistenstoselectedNetadapterTZnifferThread=Class(Tthread)privateZ:Tzniffer;publicReadTimes:integer;ConstructorCreate(Zniffer:Tzniffer);DestructorDestroy;override;ProcedureExecute;override;end;//ThemainTZnifferClasshereTZniffer=ClassprivateFPCAP:PPCAP;//HandletothepcapdriverFadapters:TstringList;//theadaptersfoundonthesystemFadapterIndex:Integer;//currentadapterFThread:TZnifferThread;//ThelisteningthreadFsnooping:Boolean;//FlagindicatingsnoopingactivityFunctionGetAdapters(VarErrStr:string):boolean;procedureThreadTerminate(Sender:tobject);procedureSetAdapterIndex(constValue:integer);publicOnPacket:Procedure(Data:pointer;recvbytes:Word)ofObject;ConstructorCreate;DestructorDestroy;override;FunctionActivate(varErrStr:string):boolean;FunctionDeactivate(varErrStr:string):boolean;propertySnooping:booleanReadFsnooping;propertyAdapters:TstringListreadFadapters;propertyAdapterIndex:integerreadFadapterIndexwriteSetAdapterIndex;end;Const//Lookinrfc1340dokumentPROTO_IP=$0800;functionTOUSHORT(x:PChar):SHORT;//RippedCMakroimplementationfunctionTOUSHORT(x:PChar):SHORT;beginResult:=(SHORT(x^)shl8)or(SHORT((x+1)^));//FPMay10,1999end;{TZniffer}constructorTZniffer.Create;varS:string;beginFAdapters:=Tstringlist.Create;FadapterIndex:=0;FPCAP:=Nil;Fsnooping:=false;GetAdapters(s);end;destructorTZniffer.Destroy;VarE:string;beginDeActivate(E);Fadapters.free;Fadapters:=nil;inherited;end;//------------------------------------------------------------------------------//ACTIVATESNOOPANDSTARTREADTHREAD//------------------------------------------------------------------------------functionTZniffer.Activate(varErrStr:string):boolean;beginResult:=false;//CheckifSnoopingisactiveifFsnoopingor(FPCAP<>nil)thenbeginErrStr:='Snoopingalreadyactivated';exit;end;//OpenDriverandNetAdapterFPCAP:=Pcap.pcap_open_live(Pchar(FAdapters[FAdapterindex]),DEFAULT_SNAPLEN,TRUE,100,ErrStr);ifFPCAP=nilthenexit;ifnotAssigned(OnPacket)thenbeginErrStr:='NoPacketReadCallbackfunctionassigned';exit;end;//StartSnoopReadThreadFThread:=TZnifferThread.create(self);Fthread.ReadTimes:=10;Fthread.OnTerminate:=ThreadTerminate;Fthread.FreeOnTerminate:=false;Fthread.resume;FSnooping:=True;result:=true;end;
解决方案八：
functionTZniffer.Deactivate(varErrStr:string):boolean;varP:Tpacket;T:longword;beginresult:=false;if(notFsnooping)thenbeginerrstr:='Snoopingnotactive';exit;end;ifFThread=nilthenbeginerrstr:='Nothreadtostop';exit;end;//StopSnoopingThreadFThread.Terminate;FThread.WaitFor;FThread.Free;Fthread:=nil;//ReleaseDriverHandlePcap_Close(FPCAP);result:=true;end;//------------------------------------------------------------------------------//GETADAPTERSINSYSTEM//------------------------------------------------------------------------------functionTZniffer.GetAdapters(varErrStr:string):boolean;beginresult:=false;ifFAdapters=nilthenbeginErrStr:='MemoryforAdapterlistnotallocated';exit;end;Fadapters.commatext:=Pcap.pcap_GetAdapternames(',',ErrStr);ifFadapters.CommaText=''thenexit;result:=true;end;//------------------------------------------------------------------------------////AndSnoopDriverCallbackfunctionwhichcannotbeprocedureofobject!//------------------------------------------------------------------------------procedureCaptureCB(User:pointer;constHeader:Ppcap_pkthdr;constData:pchar);beginTZniffer(user).OnPacket(Data,Header.len);end;//======================================================{TZnifferThread}constructorTZnifferThread.Create(Zniffer:Tzniffer);beginReadTimes:=0;Z:=Zniffer;PacketSetReadTimeout(z.Fpcap.Adapter,100);inheritedCreate(TRUE);end;destructorTZnifferThread.Destroy;begininherited;end;procedureTZnifferThread.Execute;beginifZ=nilthenexit;WhileNotTerminateddobeginPcap_Read(Z.FPCAP,0,CaptureCB,Pointer(Z));end;end;//==========================================procedureTZniffer.ThreadTerminate(Sender:tobject);beginFsnooping:=false;end;procedureTZniffer.SetAdapterIndex(constValue:integer);beginif(value>-1)and(value<Adapters.count)thenFadapterIndex:=Value;end;end.
解决方案九：
给我发以下yong85215@yahoo.com.cn
解决方案十：
给我也发一个，qiufen_1983@163.com.我做了个网络嗅探器的数据捕获，就是完成不了对数据包的保存，很着急，能不能帮帮我呢？很急需，谢谢帮忙！
解决方案十一：
请给我发一个小型的源代码开放的微型IDS好吗？小弟不胜感激！我的邮箱zhanghanyu1102@163.com
解决方案十二：
mabaolin@eyou.com谢谢。我也要一份
解决方案十三：
WINPCAP是做什么用的，有什么特别的功能吗我用rawsocket就可以捕获网络上的包了呀
解决方案十四：
楼上，rawsocket工作在网络层，根据我的经验只能捕获IP包。而WinPcap工作在链路层，可以捕获任何包。
解决方案十五：
toKvci(看了不笑就没小JJ同时又比较长的昵称__——————————————————————————————)能不能也发给我一份源代码啊？我刚入道，急需这方面的资料。谢谢。我的邮箱fanzy80@126.com谢谢。
解决方案：
各位大哥，小妹也正在做网络监听系统，我也是做WPCAP的，谁有的话也给我一份，不胜感激呀！！！！！！！！！！！！
解决方案：
我的油箱是zhangcaiyun1231993@163.com
解决方案：
很明显ls没有一个看过winpcap文档的，里头说明的很清楚
解决方案：
我也在开发一个网络监控工具,请帮忙!谢谢大家.我的邮箱:tian1982988@126.com
解决方案：
等待牛人来答.
解决方案：
好像没那么简单,呵呵.
解决方案：
gymzyt@163.com给我发个啊...谢谢啊
解决方案：
希望有的人能给兄弟我发个啊，多谢了，eline1027@yahoo.com.cn！不甚感激啊！1.使用WinPCap的接口，实现一个网络嗅探器2.完成截获数据包的功能、并具备分析数据包的功能。
解决方案：
哎呀，都不用找啦，书上就有现成的啊！抄下来就可以用的《网络安全开发包详解》
解决方案：
晕,大名鼎鼎的wireshark,以前叫ethereal,就是基于libpcap/winpcap的网络嗅探/分析器啊,它的源码是公开的............
解决方案：
你好，我的毕设也做的是和你比较像的那个企业信息安全防范，不知道你能不能把源码和相关资料也发给我一下，我做个参考，我的邮箱是yinistracy@163.com不胜感激~
解决方案：
我也要lculiuyonghua@163.com谢啦