c++ - 数据包嗅探器只检测发送的数据包

Question

我一直在研究数据包嗅探器，只是为了娱乐/教育，而且进展顺利。我遇到的问题是 recvfrom() 中出现的唯一数据包是 SENT 数据包，即以我的 IP 作为源 IP 而不是我的 WAN IP 而是我的 LAN IP 的数据包(如果这有意义的话).我尝试修复它并花了数小时阅读我能找到的所有内容，但对我来说似乎没有解决方案。我 100% 肯定我编写的代码没有检测到所有数据包，因为 wireshark 检测到更多(传入和传出)，而且很明显，我的 PC 不仅有传出流量。

packetsize = recvfrom(sniffer , Buffer , 65536 , 0 , (SOCKADDR *)&SenderAddr , &SenderAddrSize); 
for (int x = 12; x < 16; x++) 
{
    printf("%c ",Buffer[x]); 
}
std::cout << "\n";

iphdr = (IPV4_HDR *)Buffer;

memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iphdr->ip_srcaddr;
std::cout << inet_ntoa(source.sin_addr) << "\n\n";

这就是一切失败的地方(有更多的代码但并不重要)，所有结构都已正确定义，因此那里没有错误(否则我无法一遍又一遍地获得相同的 IP 地址每一个数据包)。我的网络中还有另一个不存在的 IP 显示为源 IP，而且源 IP 有时是 0.0.0.0，我都觉得这很奇怪。

缓冲区声明为

char *Buffer = (char *)malloc(65536);

所以它是带符号的字符，我不知道如何从这些值中手动“提取” header 的单独部分。

我希望任何人都可以向我解释 recvfrom 实际上并没有丢包，我做错了什么。另外，我想知道如何解释 recvfrom 的输出，即将有符号转换为无符号或其他方式？

我希望我把我的问题说清楚了，在此先感谢。

编辑。我的代码的更大块

int main()
{
    SOCKET sniffer;
    struct in_addr addr;
    int in;

    char hostname[100];
    struct hostent *local;
    WSADATA wsa;


    // Initialise Winsock

    printf("\nInitialising Winsock...");
    if (WSAStartup(MAKEWORD(2,2), &wsa) != 0)
    {
        printf("WSAStartup() failed.\n");
        getchar();
        return 1;
    }
    printf("Initialised");

    // Create a RAW Socket
    printf("\nCreating RAW Socket....");
    sniffer = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (sniffer == INVALID_SOCKET)
    {
        printf("Failed to create raw socket.\n");
        printf("WSA throws error code %d\n",WSAGetLastError());
        printf("Run as admin to fix\n");
        getchar();
        return 1;
    }
    printf("Created.");

    // Retrieve the local hostname
    if (gethostname(hostname, sizeof(hostname)) == SOCKET_ERROR)
    {
        printf("WSA throws error code %d\n",WSAGetLastError());
        getchar();
        return 1;
    }
    printf("\nHost name : %s \n",hostname);

    bool retry = true;
    signed int maxnumber = -1;

    do
    {
        // Retrieve the available IPs of the local host
        local = gethostbyname(hostname);
        printf("\nAvailable Network Interfaces  \n");
        if (local == NULL)
        {
            printf("WSA throws error code %d.\n",WSAGetLastError());
            getchar();
            return 1;
        }

        // Available interfaces
        for (i = 0; local->h_addr_list[i] != 0; i++) // h_addr_list is null terminated
        {
            // local is hostent struct in which information about the host is stored
            // in_addr represents an IPv4 internet address. inet_ntoa: in_addr to string (ip adress)
            memmove(&addr, local->h_addr_list[i], sizeof(struct in_addr));
            //memmove(destination, source, number of bytes to copy)
            printf("Interface Number : %d Address : %s\n", i, inet_ntoa(addr));
            maxnumber = i;
            printf("\n");
        }

        // Choose interface
        if (maxnumber > 0)
        {
            printf("Enter the interface number you would like to sniff : ");
            scanf("%d",&in);
            printf(" in: %d | maxnumber: %d \n", in, maxnumber);
            if (in <= maxnumber)
            {
                retry = false;
            } else {
                printf("Interface number %d with adress %d does not exist \n\n", in, local->h_addr_list[in]);
            }
        }
        else
        {
            printf("Only one interface available");
            in = 0;
            retry = false;
        }
    } while (retry);

    self = addr;
    CreateFolder(self);

    memset(&dest, 0, sizeof(dest));
    memcpy(&dest.sin_addr.s_addr,local->h_addr_list[in],sizeof(dest.sin_addr.s_addr));
    dest.sin_family = AF_INET;
    dest.sin_port = htons(source.sin_port);//=0;

    printf("\nBinding socket to local system and port 0 ...");
    if (bind(sniffer,(struct sockaddr *)&dest,sizeof(dest)) == SOCKET_ERROR)
    {
        printf("bind(%s) failed.\n", inet_ntoa(addr));
        getchar();
        return 1;
    }
    printf("Binding successful");

    j=1;
    unsigned long nbytesret;
    printf("\nSetting socket to sniff...");
    if (WSAIoctl(sniffer, SIO_RCVALL, &j, sizeof(j), 0, 0, &nbytesret , 0 , 0) == SOCKET_ERROR)
    {
        printf("WSAIoctl() failed.\n");
        getchar();
        return 1;
    }
    printf("Socket set\n");
    printf("Press enter to start\n");
    getchar();

    printf("Packet Capture Statistics...\n");
    StartSniffing(sniffer); 

    printf("Ending sniffer, press enter to exit \n");
    getchar();
    closesocket(sniffer);
    WSACleanup();

    return 0;
}

void StartSniffing(SOCKET sniffer)
{
    char *Buffer = (char *)malloc(65536);
    int packetsize;

    if (Buffer == NULL)
    {
        printf("malloc() failed.\n");
    getchar();
    return;
    }

    do
    {
        packetsize = recvfrom(sniffer , Buffer , 65536 , 0 , (SOCKADDR *)&SenderAddr , &SenderAddrSize); 

        if(packetsize > 0)
        {
            ProcessPacket(Buffer, packetsize);
        }
        else
        {
            printf( "recvfrom() failed.\n");
            getchar();
        }

    }
    while (packetsize > 0);

    free(Buffer);
}

Answer 1

要从缓冲区读取无符号指针，请像这样使用 reinterpret_cast 来获取无符号指针:

unsigned char *uBuffer = reinterpret_cast<unsigned char *>(Buffer);