[知識整理]使用RawSocket 抓包

    曾經寫過一個遠程網絡抓包工具，為啥原遠程抓了？在解決現網問題，或者統計數據，需要快速准確的抓取特點的網絡吧。我們應用都是windows機器，經常需要抓XX服務某A機到XX服務B機的網絡包，定位機器、查部署情況、IP地址、負載配置、同時操作多台設備等等都特別耗時，因為有了這個工具的設計初衷。於是開始設計使用調用Winpcap組件實現去抓，后來發現生產環境很多機器並未安裝，同時winpcap 也無法支持silence方式安裝。

   所以不得不想其他方案，這里就想到了RawSocket了，通過RawSocket 獲取全量網絡包，讓后實現winpcap相同的filter 功能，將RawSocket 數據量保持為標准的pcap格式文件，問題得到完美的解決。

代碼實現如下：

1. rawsocket

  public class RawSocket
    {
        private Socket _socket;
        private IPAddress _address;
        public Action<TcpPacket> OnTcpPacketCapture;
        public Action<byte[], int> OnRawDataCapure;
        public RawSocket(IPAddress address)
        {
            _address = address;
            _socket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
            _socket.Bind(new IPEndPoint(address, 0));
        }

        public bool Capture()
        {
            bool isOk = true;
            try
            {
                _socket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1);
                byte[] inBytes = new byte[] { 1, 0, 0, 0 };
                byte[] outBytes = new byte[] { 0, 0, 0, 0 };
                _socket.IOControl(IOControlCode.ReceiveAll, inBytes, outBytes);
                if (0 != outBytes[0] + outBytes[1] + outBytes[2] + outBytes[3]) { isOk = false; }
            }
            catch (SocketException)
            {
                isOk = false;
            }

            if (isOk)
            {
                while (true)
                {
                    //以太網MTU 最大為1500
                    byte[] buffer = new byte[1500];

                    int count = _socket.Receive(buffer, SocketFlags.None);

                    if (OnRawDataCapure != null)
                        OnRawDataCapure(buffer, count);

                    if (OnTcpPacketCapture != null)
                    {
                        IPPacket ip = new IPPacket(buffer,0,count);
                        Console.WriteLine(ip);
                        if (ip.Protocol == IPProtocolType.TCP)
                        {
                            TcpPacket tcp = new TcpPacket(ip);
                            OnTcpPacketCapture(tcp);
                        }
                    }
                }
            }

            return isOk;
        }

        public void Stop()
        {
            if (_socket != null)
            {
                _socket.Shutdown(SocketShutdown.Both);
                _socket.Close();
            }
        }
    }

    class SocketData
    {
        public Socket Socket { get; set; }
        public Byte[] Data { get; set; }
    }
    public class DataBuffer
    {
        public byte[] RawBuffer;
        public int RawStart;
        public int RawCount;

        private byte[] buffer;
        private int start;
        private int end;
        public int Length { get { return end - start; } }
        public byte this[int index] { get { return buffer[start + index]; } }

        public DataBuffer(byte[] data)
            : this(data, 0, data.Length) { }

        public DataBuffer(byte[] data, int start, int count)
        {
           this.RawBuffer= this.buffer = data;
           this.RawStart= this.start = start;
           this.RawCount = count;
            this.end = start + count;
        }

        public void SetPosition(int position)
        {
            this.start += position;
        }

        public byte[] Data
        {
            get
            {
                byte[] data = new byte[this.Length];
                Array.Copy(this.buffer, this.start, data, 0, data.Length);
                return data;
            }
        }
    }

    public class IPPacket
    {
        public int Version; //版本號
        public int HeadLen; //頭長度
        public int DiffServices; //區分服務
        public int DataLen;//數據長度
        public int Identification; //標志
        public int Flag; //標識 3bit
        public int Excursion;//片偏移 13bit
        public byte TTL;//生存周期
        public IPProtocolType Protocol; //協議
        public int CheckSum; //校驗和
        public IPAddress SrcAddr; //源地址
        public IPAddress DestAddr; //目標地址
        public byte[] option; //選項
        public DataBuffer Data; //IP Payload

        public IPPacket(byte[] data) : this(new DataBuffer(data)) { }
        public IPPacket(byte[] data, int start, int count) : this(new DataBuffer(data, start, count)) { }

        public IPPacket(DataBuffer data)
        {
            Version = (data[0] & 0xF0) >> 4;
            HeadLen = (int)(data[0] & 0x0F) * 4;
            DiffServices = (int)data[1];
            DataLen = ((int)data[2] << 8) + (int)data[3];
            Identification = ((int)data[5] << 8) + (int)data[5];
            Flag = data[6] >> 5;
            Excursion = (((int)data[6] & 0x1F) << 8) + (int)data[7];
            TTL = data[8];
            Protocol = (IPProtocolType)data[9];
            CheckSum = ((int)data[10] << 8) + (int)data[11];

            byte[] addr = new byte[4];
            for (int i = 0; i < 4; i++)
                addr[i] = data[12 + i];
            SrcAddr = new IPAddress(addr);

            addr = new byte[4];
            for (int i = 0; i < 4; i++)
                addr[i] = data[16 + i];
            DestAddr = new IPAddress(addr);

            //option
            if (HeadLen > 20)
            {
                option = new byte[HeadLen - 20];
                for (int i = 0; i < option.Length; i++)
                    option[i] = data[20 + i]; //會包括填充部分
            }

            data.SetPosition(HeadLen);
            Data = data;
        }

        public override string ToString()
        {
            StringBuilder sb = new StringBuilder();
            sb.AppendFormat("SrcAddr:{0} DestAddr={1}\r\n", SrcAddr.ToString(), DestAddr.ToString());
            sb.AppendFormat("CheckSum: {0} Protocol:{1}\r\n", CheckSum, Protocol.ToString());
            sb.AppendFormat("Version: {0} HeadLen:{1}\r\n", Version, HeadLen);
            sb.AppendFormat("DataLen: {0} DiffServices:{1}\r\n", DataLen, DiffServices);
            return sb.ToString();
        }
    }

    public class TcpPacket
    {
        public int SrcPort = 0;//源端口
        public int DestPort = 0;//目標端口
        public uint SequenceNo = 0;//序號
        public uint NextSeqNo = 0;//確認號
        public int HeadLen = 0;//頭長度
        public int Flag = 0;//控制位
        public int WindowSize = 0;//窗口
        public int CheckSum = 0;//校驗和
        public int UrgPtr = 0;//緊急指針
        public byte[] option;//選項
        public IPPacket IPPacket;
        public DataBuffer Data;
        public byte[] Body { get { return Data.Data; } }

        public TcpPacket(byte[] data) : this(new IPPacket(new DataBuffer(data))) { }
        public TcpPacket(byte[] data, int start, int count) : this(new IPPacket(new DataBuffer(data, start, count))) { }

        public TcpPacket(IPPacket packet)
        {
            if (packet.Protocol != IPProtocolType.TCP)
                throw new NotSupportedException(string.Format("TcpPacket not support {0}", packet.Protocol));
            this.IPPacket = packet;

            DataBuffer data = packet.Data;
            SrcPort = ((int)data[0] << 8) + (int)data[1];
            DestPort = ((int)data[2] << 8) + (int)data[3];

            SequenceNo = ((uint)data[7] << 24) + ((uint)data[6] << 16) + ((uint)data[5] << 8) + ((uint)data[4]);
            NextSeqNo = ((uint)data[11] << 24) + ((uint)data[10] << 16) + ((uint)data[9] << 8) + ((uint)data[8]);

            HeadLen = ((data[12] & 0xF0) >> 4)*4;
            //6bit保留位
            Flag = (data[13] & 0x3F);
            WindowSize = ((int)data[14] << 8) + (int)data[15];
            CheckSum = ((int)data[16] << 8) + (int)data[17];
            UrgPtr = ((int)data[18] << 8) + (int)data[19];
            //option
            if (HeadLen > 20)
            {
                option = new byte[HeadLen - 20];
                for (int i = 0; i < option.Length; i++)
                    option[i] = data[20 + i]; //會包括填充部分
            }

            data.SetPosition(this.HeadLen);
            Data = data;
        }

        public override string ToString()
        {
            StringBuilder sb = new StringBuilder();
            sb.AppendFormat("SrcPort:{0} DestPort={1}\r\n", SrcPort, DestPort);
            sb.AppendFormat("SequenceNo:{0} NextSeqNo={1}\r\n", SequenceNo, NextSeqNo);
            sb.AppendFormat("HeadLen:{0} Flag={1}\r\n", HeadLen, Flag);
            sb.AppendFormat("WindowSize:{0} CheckSum={1}\r\n", WindowSize, CheckSum);
            return sb.ToString();
        }
    }

    public enum IPProtocolType : byte
    {
        /// <summary> Dummy protocol for TCP. </summary>
        IP = 0,
        /// <summary> IPv6 Hop-by-Hop options. </summary>
        HOPOPTS = 0,
        /// <summary> Internet Control Message Protocol. </summary>
        ICMP = 1,
        /// <summary> Internet Group Management Protocol.</summary>
        IGMP = 2,
        /// <summary> IPIP tunnels (older KA9Q tunnels use 94). </summary>
        IPIP = 4,
        /// <summary> Transmission Control Protocol. </summary>
        TCP = 6,
        /// <summary> Exterior Gateway Protocol. </summary>
        EGP = 8,
        /// <summary> PUP protocol. </summary>
        PUP = 12,
        /// <summary> User Datagram Protocol. </summary>
        UDP = 17,
        /// <summary> XNS IDP protocol. </summary>
        IDP = 22,
        /// <summary> SO Transport Protocol Class 4. </summary>
        TP = 29,
        /// <summary> IPv6 header. </summary>
        IPV6 = 41,
        /// <summary> IPv6 routing header. </summary>
        ROUTING = 43,
        /// <summary> IPv6 fragmentation header. </summary>
        FRAGMENT = 44,
        /// <summary> Reservation Protocol. </summary>
        RSVP = 46,
        /// <summary> General Routing Encapsulation. </summary>
        GRE = 47,
        /// <summary> encapsulating security payload. </summary>
        ESP = 50,
        /// <summary> authentication header. </summary>
        AH = 51,
        /// <summary> ICMPv6. </summary>
        ICMPV6 = 58,
        /// <summary> IPv6 no next header. </summary>
        NONE = 59,
        /// <summary> IPv6 destination options. </summary>
        DSTOPTS = 60,
        /// <summary> Multicast Transport Protocol. </summary>
        MTP = 92,
        /// <summary> Encapsulation Header. </summary>
        ENCAP = 98,
        /// <summary> Protocol Independent Multicast. </summary>
        PIM = 103,
        /// <summary> Compression Header Protocol. </summary>
        COMP = 108,
        /// <summary> Raw IP packets. </summary>
        RAW = 255,
        /// <summary> IP protocol mask.</summary>
        MASK = 0xff
    }

2. PcapDumper 用戶保存pcap文件格式：

 public class PcapDumper
    {
        private PcapStream context;
        public PcapDumper(Stream stream)
        {
            context = new PcapStream(stream);
            PcapHeader header = new PcapHeader();
            header.Writer(context);
            stream.Flush();
        }

        public void Write(byte[] buffer, int offset, int count)
        {
            RecordPacket record = new RecordPacket(buffer, offset, count);
            record.Write(context);
        }

        public void Write(TcpPacket packet)
        {
            Write(packet.IPPacket.Data.RawBuffer, packet.IPPacket.Data.RawStart, packet.IPPacket.Data.RawCount);
        }

        public void Write(IPPacket packet)
        {
            Write(packet.Data.RawBuffer, packet.Data.RawStart, packet.Data.RawCount);
        }

        public void Flush()
        {
            context.Flush();
        }
    }

    public class PcapHeader
    {
        //for intel x86 save as litle-endian
        public uint MagicNumber = 0xa1b2c3d4;// native byte ordering. magic number
        public ushort VersionMajor = 0x2; //current 2.4
        public ushort VersionMinor = 0x4;
        public uint TimeZone = 0;//timeezone 實際上沒有被使用過
        public uint SigFigs = 0;//useless
        public uint Snaplen = 65535;//maxlen just set the max
        public uint Network = 1;//Ethernet

        public void Writer(PcapStream stream)
        {
            stream.Write(MagicNumber);
            stream.Write(VersionMajor);
            stream.Write(VersionMinor);
            stream.Write(TimeZone);
            stream.Write(SigFigs);
            stream.Write(Snaplen);
            stream.Write(Network);
        }
    }


    public class RecordPacket
    {
        private DateTime unixTime = new DateTime(1970, 1, 1);
        private int EntherNetLen = 14;//srcIP+dstIP+ verion 14b 頭
        private int offset;
        private int count;
        private byte[] buffer;

        public RecordPacket(byte[] buffer, int offset, int count)
        {
            DateTime time = DateTime.UtcNow;
            TimeSec = (uint)((time - unixTime).TotalSeconds);
            TimeMicroSec = (uint)time.Millisecond * 1000;
            CapLen = Len = (uint)count + 14;
            this.offset = offset;
            this.count = count;
            this.buffer = buffer;
        }

        public uint TimeSec;         /* timestamp seconds */
        public uint TimeMicroSec;        /* timestamp microseconds */
        public uint CapLen;       /* number of octets of packet saved in file */
        public uint Len;       /* actual length of packet */

        public void Write(PcapStream stream)
        {
            stream.Write(TimeSec);
            stream.Write(TimeMicroSec);
            stream.Write(CapLen);
            stream.Write(Len);
            stream.Write((ulong)1, 6);
            stream.Write((ulong)2, 6); //這兩個應該是鏈路mac地址，隨便代替就行
            stream.Write(8);
            stream.Write(0);//IP 0x08
            stream.Write(buffer, offset, count);
        }
    }

    public class PcapStream
    {
        private byte[] tempBuffer = new byte[8];
        private Stream stream;
        public PcapStream(Stream stream)
        {
            this.stream = stream;
        }

        public void Flush()
        {
            stream.Flush();
        }

        public void Write(ushort v)
        {
            Write(v, 2);
        }

        public void Write(uint v)
        {
            Write(v, 4);
        }

        public void Write(ulong v)
        {
            Write(v, 8);
        }

        public void Write(ulong v, int numbytes)
        {
            ulong val = v;
            for (int x = 0; x < numbytes; x++)
            {
                tempBuffer[x] = (byte)(val & 0xff);
                val >>= 8;
            }
            stream.Write(tempBuffer, 0, numbytes);
        }

        public void Write(byte value)
        {
            stream.WriteByte(value);
        }

        public void Write(byte[] buffer, int offset, int count)
        {
            stream.Write(buffer, offset, count);
        }

        public void Write(byte[] buffer)
        {
            stream.Write(buffer, 0, buffer.Length);
        }
    }
}

/// 參考資料：http://wiki.wireshark.org/Development/LibpcapFileFormat
//magic_number: used to detect the file format itself and the byte ordering. The writing application writes 0xa1b2c3d4 with it's native byte ordering format into this field. The reading application will read either 0xa1b2c3d4 (identical) or 0xd4c3b2a1 (swapped). If the reading application reads the swapped 0xd4c3b2a1 value, it knows that all the following fields will have to be swapped too.
//version_major, version_minor: the version number of this file format (current version is 2.4)
//thiszone: the correction time in seconds between GMT (UTC) and the local timezone of the following packet header timestamps. Examples: If the timestamps are in GMT (UTC), thiszone is simply 0. If the timestamps are in Central European time (Amsterdam, Berlin, ...) which is GMT + 1:00, thiszone must be -3600. In practice, time stamps are always in GMT, so thiszone is always 0.
//sigfigs: in theory, the accuracy of time stamps in the capture; in practice, all tools set it to 0
//snaplen: the "snapshot length" for the capture (typically 65535 or even more, but might be limited by the user), see: incl_len vs. orig_len below
//network: link-layer header type, specifying the type of headers at the beginning of the packet (e.g. 1 for Ethernet, see tcpdump.org's link-layer header types page for details); this can be various types such as 802.11, 802.11 with various radio information, PPP, Token Ring, FDDI, etc.
//0            BSD       loopback devices, except for later OpenBSD
//1            Ethernet, and Linux loopback devices
//6            802.5 Token Ring
//7            ARCnet
//8            SLIP
//9            PPP
//10          FDDI
//100        LLC/SNAP-encapsulated ATM
//101        raw IP, with no link
//102        BSD/OS SLIP
//103        BSD/OS PPP
//104        Cisco HDLC
//105        802.11
//108        later OpenBSD loopback devices (with the AF_value in network byte order)
//113               special Linux cooked capture
//114               LocalTalk

//ts_sec: the date and time when this packet was captured. This value is in seconds since January 1, 1970 00:00:00 GMT; this is also known as a UN*X time_t. You can use the ANSI C time() function from time.h to get this value, but you might use a more optimized way to get this timestamp value. If this timestamp isn't based on GMT (UTC), use thiszone from the global header for adjustments.
//ts_usec: the microseconds when this packet was captured, as an offset to ts_sec.  Beware: this value shouldn't reach 1 second (1 000 000), in this case ts_sec must be increased instead!
//incl_len: the number of bytes of packet data actually captured and saved in the file. This value should never become larger than orig_len or the snaplen value of the global header.
//orig_len: the length of the packet as it appeared on the network when it was captured. If incl_len and orig_len differ, the actually saved packet size was limited by snaplen.

3. 最后是Filter功能：

class PcapFilter
   {
       private const string CONST_AND = "and";
       private const string CONST_OR = "or";
       private const string CONST_HOST = "host";
       private const string CONST_TCP = "tcp";
       private const string CONST_PORT = "port";

       private string filter;
       private Func<TcpPacket, bool> filterAction = (packet) => { return true; };
       private List<Func<TcpPacket, bool>> _funcs=new List<Func<TcpPacket,bool>>();
       private bool _isAnd = false;

       public PcapFilter(string filter)
       {
           if (!string.IsNullOrEmpty(filter))
           {
               this.filter = filter.Trim().ToLower();
               if (!string.IsNullOrEmpty(this.filter))
                   TryParserFilter();
           }
       }

       private void TryParserFilter()
       {
           string[] sp = filter.Split(new char[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
           sp = sp.Where(p => p.Trim().Length > 0).ToArray();

           if (sp.Where(p => p == CONST_OR || p == CONST_AND).Count() > 1)
               throw new NotSupportedException("only support one or/and");

           TokenState ns = TokenState.Name;
           string name = string.Empty;

           for (int i=0;i<sp.Length;i++)
           {
               if (ns == TokenState.Name)
               {
                   if (sp[i] == CONST_TCP && sp[i + 1] == CONST_PORT)
                   {
                       name = CONST_TCP;
                       i++;
                       ns = TokenState.Value;
                   }
                   else if (sp[i] == CONST_HOST)
                   {
                       name = CONST_HOST;
                       ns = TokenState.Value;
                   }
                   else
                       throw new NotSupportedException();
               }
               else if (ns == TokenState.Operation)
               {
                   if (sp[i] == CONST_AND)
                       _isAnd = true;
                   else
                       _isAnd = false;
                   ns = TokenState.Name;
               }
               else if (ns == TokenState.Value)
               {
                   ParseAction(name, sp[i]);
                   ns = TokenState.Operation;
               }
           }

           filterAction=(packet)=>
               {
                   if (_funcs.Count > 0)
                   {
                       if (_funcs.Count == 1)
                           return _funcs[0](packet);
                       else
                       {
                       if(_isAnd)
                           return _funcs[0](packet) && _funcs[1](packet);
                       }
                   }
                   return true;
               };
       }

       private void ParseAction(string name, string value)
       {
           if (name == CONST_HOST)
           {
               IPAddress ip = IPAddress.Parse(value);
               _funcs.Add(new Func<TcpPacket, bool>((pachet) =>
                   {
                       return pachet.IPPacket.SrcAddr.Equals(ip) || pachet.IPPacket.DestAddr.Equals(ip);
                   }));
           }
           else
           {
               int port = Convert.ToInt32(value);
               _funcs.Add(new Func<TcpPacket, bool>((packet) =>
                   {
                       return packet.SrcPort == port || packet.DestPort == port;
                   }));
           }
       }

       public bool IsFilter(TcpPacket packet)
       {
           return filterAction(packet);
       }
   }

   enum TokenState
   {
       Name,
       Value,
       Operation,
   }