c# - 无法从 SharpPcap.RawCapture 转换为 PacketDotNet.Packet

Question

我一直在关注 http://www.codeproject.com/KB/IP/sharppcap.aspx 上的指南为了实现一个简单的数据包嗅探器来为我自动进行身份验证，我设法进入了过滤部分，并且到目前为止必须对教程代码进行一些调整才能正常工作，但我现在被难住了。

我收到的错误是；

The best overloaded method match for 'PacketDotNet.TcpPacket.GetEncapsulated(PacketDotNet.Packet)' has some invalid arguments

Argument 1: cannot convert from 'SharpPcap.RawCapture' to 'PacketDotNet.Packet'

但我自己还没有对 PacketDotNet 进行任何引用(到目前为止一切都是 SharpPcap)。

我目前拥有的全部代码都包含在内，问题出在 device_OnPacketArrival() 函数中。

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;
 using PacketDotNet;
 using SharpPcap;

 namespace ConsoleApplication1
 {
     class Program
     {
         static void Main(string[] args)
         {
             string ver = SharpPcap.Version.VersionString;
             Console.WriteLine("SharpPcap {0}, Example1.IfList.cs", ver);

             // Retrieve the device list
             CaptureDeviceList devices = CaptureDeviceList.Instance;

             // If no devices were found print an error
             if (devices.Count < 1)
             {
                 Console.WriteLine("No devices were found on this machine");
                 return;
             }

             // Extract a device from the list
             ICaptureDevice device = devices[0];

             // Register our handler function to the
             // 'packet arrival' event
             device.OnPacketArrival +=
                 new SharpPcap.PacketArrivalEventHandler(device_OnPacketArrival);

             // Open the device for capturing
             int readTimeoutMilliseconds = 1000;
             device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);

             // tcpdump filter to capture only TCP/IP packets
             string filter = "ip and tcp";
             device.Filter = filter;

             Console.WriteLine();
             Console.WriteLine("-- The following tcpdump filter will be applied: \"{0}\"",
                 filter);
             Console.WriteLine("-- Listening on {0}, hit 'Enter' to stop...",
                 device.Description);

             // Start capturing packets indefinitely
             device.Capture();

             // Close the pcap device
             // (Note: this line will never be called since
             // we're capturing indefinitely
             device.Close();
         }
         private static void device_OnPacketArrival(object sender, CaptureEventArgs e)
         {
             var tcp = TcpPacket.GetEncapsulated(e.Packet);
         }
     }
 }

Answer 1

SharpPcap.RawPacket 用于保存通过网络适配器捕获的原始数据，但 PacketDotNet 需要在 GetEncapsulated() 方法工作之前解析数据包。您需要的步骤如下所示:

var packet = PacketDotNet.Packet.ParsePacket(rawPacket.LinkLayerType, rawPacket.Data);

然后您可以通过GetEncapsulated() 方法将封装的TcpPacket 传递给packet 来提取它。

SharpPcap 源代码下载中的示例 12 https://sourceforge.net/projects/sharppcap/显示语法以及如何修改数据包。

请记住，PacketType.GetEncapsulated() 正在返回对数据包该部分的引用，因此修改它会改变原始数据包。