C# 利用SharpPcap實現網絡包捕獲嗅探

本文是利用SharpPcap實現網絡包的捕獲的小例子，實現了端口監控，數據包捕獲等功能，主要用於學習分享。

什么是SharpPcap？

SharpPcap 是一個.NET 環境下的網絡包捕獲框架，基於著名的 pcap/WinPcap 庫開發。提供了捕獲、注入、分析和構建的功能，適用於 C# 和 VB NET 開發語言。

SharpPcap有兩部分組成：1> SharpPcap.dll 負責數據的捕獲  2> PacketDotNet.dll負責數據包的解析

思路：

1. 通過進程名字獲取對應的端口號。
2. SharpPcap獲取對應的數據包，通過解析數據包過濾相關的端口。

涉及知識點：

• Process 獲取相關進程信息。
• netstat命令：netstat -ano|find "3844" 獲取進程對應的端口
• SharpPcap相關信息：
  • 通過CaptureDeviceList的靜態方法獲取設備列表。
  • 通過OnPacketArrival事件接收數據包。
  • 通過PacketDotNet來解析數據包

效果圖下：

SharpPcap核心代碼：

        /// <summary>
        /// 開始捕捉
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnStart_Click(object sender, EventArgs e)
        {
            if (this.combDevice.SelectedIndex > -1)
            {
                StartCapture(this.combDevice.SelectedIndex);
                this.btnStart.Enabled = false;
                this.btnStop.Enabled = true;
            }
            else {
                MessageBox.Show(this,"請選擇一個設備","提示",MessageBoxButtons.OK);
            }
        }

        /// <summary>
        /// 停止捕捉
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnStop_Click(object sender, EventArgs e)
        {
            Shutdown();
            this.btnStop.Enabled = false;
            this.btnStart.Enabled = true;
        }

        private void StartCapture(int itemIndex)
        {
            packetCount = 0;
            device = CaptureDeviceList.Instance[itemIndex];
            packetStrings = new Queue<PacketWrapper>();
            bs = new BindingSource();
            dgvData.DataSource = bs;
            LastStatisticsOutput = DateTime.Now;

            // start the background thread
            backgroundThreadStop = false;
            backgroundThread = new Thread(BackgroundThread);
            backgroundThread.Start();

            
            // setup background capture
            device.OnPacketArrival += new PacketArrivalEventHandler(device_OnPacketArrival);
            device.OnCaptureStopped +=  new CaptureStoppedEventHandler(device_OnCaptureStopped);
            device.Open();

            // tcpdump filter to capture only TCP/IP packets
            string filter = "ip and tcp";
            device.Filter = filter;

            // force an initial statistics update
            captureStatistics = device.Statistics;
            UpdateCaptureStatistics();

            // start the background capture
            device.StartCapture();

            btnStop.Enabled = true;
        }

        /// <summary>
        /// 設備接收事件
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void device_OnPacketArrival(object sender, CaptureEventArgs e)
        {
            // print out periodic statistics about this device
            var Now = DateTime.Now;
            var interval = Now - LastStatisticsOutput;
            if (interval > new TimeSpan(0, 0, 2))
            {
                Console.WriteLine("device_OnPacketArrival: " + e.Device.Statistics);
                captureStatistics = e.Device.Statistics;
                statisticsUiNeedsUpdate = true;
                LastStatisticsOutput = Now;
            }
            
            lock (QueueLock)
            {
                PacketQueue.Add(e.Packet);
            }
        }

        /// <summary>
        /// 設備停止事件
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="status"></param>
        private void device_OnCaptureStopped(object sender, CaptureStoppedEventStatus status)
        {
            if (status != CaptureStoppedEventStatus.CompletedWithoutError)
            {
                MessageBox.Show("Error stopping capture", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
        }

        private void UpdateCaptureStatistics()
        {
            tlblStatistic.Text = string.Format("接收包: {0}, 丟棄包: {1}, 接口丟棄包: {2}", captureStatistics.ReceivedPackets,captureStatistics.DroppedPackets, captureStatistics.InterfaceDroppedPackets);
        }

關於SharpPcap手冊

源碼下載