数据包分析

想要知道如何解析IP数据包，就要知道不同的IP数据包的包头结构，于是我们上⽹查查资料：

以太网数据包

ARP数据包

IPv4

IPv6

TCP

UDP

ICMP

ICMPv6

根据以上数据包头结构，我们就有了我们的protocol.h文件，声明各种数据包：

#ifndef PROTOCOL_H
#define PROTOCOL_H
#define HAVE_REMOTE
#define PROTO_ICMP 1
#define PROTO_TCP 6
#define PROTO_UDP 17
#include <iostream>
#include <QObject>
#include "_bsd_types.h"
#include "pcap.h"
using namespace std;
//IPV4
typedef struct ip_address{u_char byte1;u_char byte2;u_char byte3;u_char byte4;
}ip_address;typedef struct ipv6_address
{u_char byte1;u_char byte2;u_char byte3;u_char byte4;u_char byte5;u_char byte6;u_char byte7;u_char byte8;
}ipv6_address;typedef struct ipv4_header{u_char ver_ihl;u_char tos;u_short tlen;u_short Identification;u_short flags_fo;u_char ttl;u_char proto;u_short crc;ip_address srcaddr;ip_address dstaddr;u_int op_pad;
}ipv4_header;typedef struct ipv6_header{u_int ver:4,flowtype:8,flowtip:20;u_short len;u_char pnext;u_char lim;ipv6_address srcaddr;ipv6_address dstaddr;
}ipv6_header;typedef struct tcp_header{u_short srcport;u_short dstport;u_int seq;u_int ack_seq;u_short resl:4,doff:4,fin:1,syn:1,pst:1,psh:1,ack:1,urg:1,ece:1,cwr:1;u_short window;u_short check;u_short urg_ptr;u_int opt;
}tcp_header;typedef struct udp_header{u_short srcport;u_short dstport;u_short tlen;u_short crc;
}udp_header;typedef struct icmp_header{u_char type;u_char code;u_char seq;u_char crc;
}icmp_header;typedef struct icmp6_header{u_char type;u_char code;u_char seq;u_char crc;u_char op_type;u_char op_len;u_char op_ethaddr[6];
}icmp6_header;typedef struct pkg_count{int n_tcp;int n_udp;int n_icmp;int n_icmp6;int n_http;int n_arp;int n_ipv4;int n_ipv6;int n_other;int n_ttl;
}pkg_count;typedef struct arp_header{u_short hardware;u_short proto;u_char ml;u_char ipl;u_short opt;u_char sm[6];ip_address sip;u_char dm[6];ip_address dip;
}arp_hearder;typedef struct eth_header{u_char smac[6];u_char dmac[6];u_short type;
}eth_header;typedef struct pkg_data
{QString pkgtype;int time[6];int len;eth_header *ethh;ipv4_header *ipv4h;ipv6_header *ipv6h;arp_header *arph;udp_header *udph;tcp_header *tcph;icmp_header *icmph;icmp6_header *icmp6;void *apph;}pkg_data;#endif // PROTOCOL_H

再对数据包的结构进行了解后，我们就需要对这些包进行解析，所以我们需要一个packettools类，里面用静态函数写出包的解析，供我们在别的地方调用：

#ifndef PACKETTOOLS_H
#define PACKETTOOLS_H
#include <QObject>
#include <QTextEdit>
#include "protocol.h"
#include "iostream"using namespace std;class PacketTools
{
public:static int unpcak_Frame(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpcak_Arp(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Ip(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Ipv6(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Icmp(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Icmp6(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Tcp(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int unpack_Udp(const u_char *pkg,pkg_data *data,pkg_count *pkgCnts);static int pack_Print(u_char *pkg,int size,QTextEdit *edit);
};#endif // PACKETTOOLS_H

主要一点就是要知道父类数据包的type字段对子类数据包的分类，然后将数据包拷贝储存到全局容器里面。