C++ 讀取 pcap文件.

http://blog.csdn.net/haolipengzhanshen/article/details/51854853

1.了解下pcap文件的結構

2.定義pcap文件頭部結構體pcapFileHeader_t,
定義pcap數據包頭部結構體pcapPkthdr_t
3.代碼實現
base_type.h

#ifndef BASE_TYPE_H #define BASE_TYPE_H typedef unsigned char uchar8_t; typedef char char8_t; typedef unsigned short uint16_t; typedef short int16_t; typedef unsigned int uint32_t; typedef int int32_t; typedef unsigned long ulong64_t; typedef long long64_t; const uint32_t MAX_MTU = 1500; //設置最大MTU為1500 const int ETHER_DATA_MIN_SIZE = 28; //IP頭長度 + UDP 長度 const int HTTP_PORT_NUMBER = 80; //默認HTTP端口號 #endif

pcap.h

#ifndef PCAP_H #define PCAP_H #include "base_type.h" #include <queue> #include <fstream> #include <iostream> using namespace std; #define PCAP_FILE_MAGIC_1 0Xd4 #define PCAP_FILE_MAGIC_2 0Xc3 #define PCAP_FILE_MAGIC_3 0Xb2 #define PCAP_FILE_MAGIC_4 0Xa1 /*pcap file header*/ typedef struct pcapFileHeader { uchar8_t magic[4]; uint16_t version_major; uint16_t version_minor; int32_t thiszone; /*時區修正*/ uint32_t sigfigs; /*精確時間戳*/ uint32_t snaplen; /*抓包最大長度*/ uint32_t linktype; /*鏈路類型*/ } pcapFileHeader_t; /*pcap packet header*/ typedef struct pcapPkthdr { uint32_t seconds; /*秒數*/ uint32_t u_seconds; /*毫秒數*/ uint32_t caplen; /*數據包長度*/ uint32_t len; /*文件數據包長度*/ } pcapPkthdr_t; class Pcap { public: Pcap(const char* fileName); ~Pcap(); void parsePcapFile(queue<string>& rawQueue); private: ifstream fileHandler; const char* fileName; }; #endif

1

pcap類只有一個parsePcapFile接口,fileName記錄pcap文件的名稱

pcap.cpp

#include "pcap.h" Pcap::Pcap(const char* fileName) { this->fileName = fileName; } void Pcap::parsePcapFile(queue<string>& rawQueue) { pcapFileHeader_t pcapFileHeader = {0}; pcapPkthdr_t packetHeader = {0}; fileHandler.open(fileName); if (!fileHandler) { cout << "The file does not exits or file name is error" << endl; return; } //讀取pcap文件頭部長度 fileHandler.read((char8_t*)&pcapFileHeader, sizeof(pcapFileHeader)); if (pcapFileHeader.magic[0] != PCAP_FILE_MAGIC_1 || pcapFileHeader.magic[1] != PCAP_FILE_MAGIC_2 || pcapFileHeader.magic[2] != PCAP_FILE_MAGIC_3 || pcapFileHeader.magic[3] != PCAP_FILE_MAGIC_4) { cout << "The file is not a pcap file" << endl; return; } while (fileHandler.read((char8_t*)&packetHeader, sizeof(packetHeader))) { uint32_t len = packetHeader.caplen; // if (packetHeader.caplen != packetHeader.len) { //cout << "It is a invalid packet" << endl; //fileHandler.seekg(packetHeader.caplen, ios::cur); //continue; } char8_t *buf = new char8_t[len]; if (NULL == buf) { return; } fileHandler.read(buf, len); string temp(buf, len); rawQueue.push(temp); delete buf; } } Pcap::~Pcap() { fileHandler.close(); }

其實Linux平台下的libpcap庫也能處理pcap的離線文件,比如tcpflow的C++版本的-r參數就是處理pcap離線文件的

待時間充裕玩玩看看,分析出來個思路來.