Różnice między wybraną wersją a wersją aktualną.
Nowa wersja | Poprzednia wersja | ||
narzedzia:packet_sniffer [2025/05/13 13:38] – utworzono administrator | narzedzia:packet_sniffer [2025/05/16 18:45] (aktualna) – administrator | ||
---|---|---|---|
Linia 1: | Linia 1: | ||
- | ====== Packet Sniffer w C# ====== | + | ====== |
- | <code cs main.cs> | + | {{ : |
- | using System; | + | |
- | using System.Collections.Generic; | + | Poniżej jest instrukcja jak skorzystać z aplikacji |
- | using System.ComponentModel; | + | {{: |
- | using System.Data; | + | przed uruchomieniem może nam się wyświetlić takie okno, |
- | using System.Drawing; | + | jeżeli tak się stanie to pobieramy framework a potem idziemy dalej |
- | using System.Text; | + | {{: |
- | using System.Windows.Forms; | + | uruchamiamy aplikację z uprawnieniami administratora |
- | using System.Net.Sockets; | + | {{: |
- | using System.Net; | + | następnie wybieramy adres IP na którym będziemy nasłuchiwać |
+ | {{: | ||
- | namespace MJsniffer | + | naciskamy przycisk start |
- | { | + | {{: |
- | public enum Protocol | + | a potem oglądamy ruch sieciowy aplikacja powinna wyświetlać UDP TCP DNS |
- | { | + | <code csharp main.cs> |
- | + | using System; | |
- | TCP = 6, | + | using System.Collections.Generic; |
- | + | using System.ComponentModel; | |
- | UDP = 17, | + | using System.Data; |
- | + | using System.Drawing; | |
- | Unknown = -1 | + | using System.Text; |
- | + | using System.Windows.Forms; | |
- | }; | + | using System.Net.Sockets; |
- | + | using System.Net; | |
- | + | ||
- | public partial class MJsnifferForm : Form | + | |
+ | namespace MJsniffer | ||
{ | { | ||
+ | public enum Protocol | ||
+ | { | ||
+ | TCP = 6, | ||
+ | UDP = 17, | ||
+ | Unknown = -1 | ||
+ | }; | ||
- | //label1.Text | + | public partial class MJsnifferForm : Form |
+ | { | ||
+ | private Socket mainSocket; | ||
+ | private byte[] byteData | ||
+ | private bool bContinueCapturing = false; // flaga która sprawdza czy pakiety zostały złapane poprawnie | ||
+ | private delegate void AddTreeNode(TreeNode node); | ||
- | private Socket mainSocket; //Socket który przechwytuje wszystkie pakiety | + | public MJsnifferForm() |
+ | { | ||
+ | InitializeComponent(); | ||
+ | } | ||
- | private | + | |
+ | { | ||
+ | if (cmbInterfaces.Text | ||
+ | { | ||
+ | MessageBox.Show(" | ||
+ | MessageBoxButtons.OK, | ||
+ | return; | ||
+ | } | ||
- | private bool bContinueCapturing = false; //flaga która sprawdza czy pakiety zostaly zlapane poprawnie | + | try |
+ | { | ||
+ | if (!bContinueCapturing) | ||
+ | { | ||
+ | btnStart.Text | ||
+ | bContinueCapturing = true; | ||
+ | mainSocket = new Socket(AddressFamily.InterNetwork, | ||
+ | mainSocket.Bind(new IPEndPoint(IPAddress.Parse(cmbInterfaces.Text), | ||
- | private delegate void AddTreeNode(TreeNode node); | + | mainSocket.SetSocketOption(SocketOptionLevel.IP, |
+ | byte[] byTrue = new byte[4] { 1, 0, 0, 0 }; | ||
+ | byte[] byOut = new byte[4] { 1, 0, 0, 0 }; | ||
- | public MJsnifferForm() | + | mainSocket.IOControl(IOControlCode.ReceiveAll, |
- | { | + | mainSocket.BeginReceive(byteData, |
+ | new AsyncCallback(OnReceive), | ||
+ | } | ||
+ | else | ||
+ | | ||
+ | btnStart.Text = "& | ||
+ | bContinueCapturing = false; | ||
+ | mainSocket.Close(); | ||
+ | } | ||
+ | } | ||
+ | catch (Exception ex) | ||
+ | { | ||
+ | MessageBox.Show(ex.Message, | ||
+ | } | ||
+ | } | ||
- | InitializeComponent(); | + | private void OnReceive(IAsyncResult ar) |
+ | { | ||
+ | try | ||
+ | { | ||
+ | int nReceived = mainSocket.EndReceive(ar); | ||
+ | ParseData(byteData, | ||
- | } | + | if (bContinueCapturing) |
+ | { | ||
+ | byteData = new byte[4096]; | ||
+ | mainSocket.BeginReceive(byteData, | ||
+ | new AsyncCallback(OnReceive), | ||
+ | } | ||
+ | } | ||
+ | catch (ObjectDisposedException) { } | ||
+ | catch (Exception ex) | ||
+ | { | ||
+ | MessageBox.Show(ex.Message, | ||
+ | } | ||
+ | | ||
+ | private void ParseData(byte[] byteData, int nReceived) | ||
+ | { | ||
+ | TreeNode rootNode = new TreeNode(); | ||
+ | IPHeader ipHeader = new IPHeader(byteData, | ||
+ | TreeNode ipNode = MakeIPTreeNode(ipHeader); | ||
+ | rootNode.Nodes.Add(ipNode); | ||
- | private void btnStart_Click(object sender, EventArgs e) // przy nacisnieciu przycisku | + | switch |
+ | { | ||
+ | case Protocol.TCP: | ||
+ | TCPHeader tcpHeader = new TCPHeader(ipHeader.Data, ipHeader.MessageLength); | ||
+ | TreeNode tcpNode = MakeTCPTreeNode(tcpHeader); | ||
+ | rootNode.Nodes.Add(tcpNode); | ||
- | { | + | if (tcpHeader.DestinationPort == " |
+ | | ||
+ | TreeNode dnsNode = MakeDNSTreeNode(tcpHeader.Data, | ||
+ | rootNode.Nodes.Add(dnsNode); | ||
+ | } | ||
+ | break; | ||
- | if (cmbInterfaces.Text == "" | + | case Protocol.UDP: |
+ | UDPHeader udpHeader = new UDPHeader(ipHeader.Data, (int)ipHeader.MessageLength); | ||
+ | TreeNode udpNode | ||
+ | rootNode.Nodes.Add(udpNode); | ||
- | { | + | if (udpHeader.DestinationPort == " |
+ | | ||
+ | TreeNode dnsNode = MakeDNSTreeNode(udpHeader.Data, | ||
+ | Convert.ToInt32(udpHeader.Length) - 8); | ||
+ | rootNode.Nodes.Add(dnsNode); | ||
+ | } | ||
+ | break; | ||
- | MessageBox.Show(" | + | case Protocol.Unknown: |
+ | break; | ||
+ | } | ||
- | MessageBoxButtons.OK, MessageBoxIcon.Error); | + | AddTreeNode addTreeNode = new AddTreeNode(OnAddTreeNode); |
+ | rootNode.Text = ipHeader.SourceAddress.ToString() + " - " + ipHeader.DestinationAddress.ToString(); | ||
+ | treeView.Invoke(addTreeNode, | ||
+ | } | ||
- | return; | + | private TreeNode MakeIPTreeNode(IPHeader ipHeader) |
+ | { | ||
+ | TreeNode ipNode = new TreeNode(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
- | } | + | string protocolStr = ipHeader.ProtocolType switch |
+ | { | ||
+ | Protocol.TCP => " | ||
+ | Protocol.UDP => " | ||
+ | _ => " | ||
+ | | ||
+ | ipNode.Nodes.Add(" | ||
- | try | + | ipNode.Nodes.Add(" |
+ | ipNode.Nodes.Add(" | ||
+ | ipNode.Nodes.Add(" | ||
- | { | + | return ipNode; |
+ | } | ||
- | if (!bContinueCapturing) | + | private TreeNode MakeTCPTreeNode(TCPHeader tcpHeader) |
+ | { | ||
+ | TreeNode tcpNode = new TreeNode(" | ||
+ | tcpNode.Nodes.Add(" | ||
+ | tcpNode.Nodes.Add(" | ||
+ | tcpNode.Nodes.Add(" | ||
- | { | + | if (!string.IsNullOrEmpty(tcpHeader.AcknowledgementNumber)) |
+ | tcpNode.Nodes.Add(" | ||
- | // | + | tcpNode.Nodes.Add(" |
+ | tcpNode.Nodes.Add(" | ||
+ | tcpNode.Nodes.Add(" | ||
+ | tcpNode.Nodes.Add(" | ||
+ | if (!string.IsNullOrEmpty(tcpHeader.UrgentPointer)) | ||
+ | tcpNode.Nodes.Add(" | ||
- | btnStart.Text = "& | + | return tcpNode; |
+ | } | ||
+ | private TreeNode MakeUDPTreeNode(UDPHeader udpHeader) | ||
+ | { | ||
+ | TreeNode udpNode = new TreeNode(" | ||
+ | udpNode.Nodes.Add(" | ||
+ | udpNode.Nodes.Add(" | ||
+ | udpNode.Nodes.Add(" | ||
+ | udpNode.Nodes.Add(" | ||
+ | return udpNode; | ||
+ | } | ||
- | bContinueCapturing | + | private TreeNode MakeDNSTreeNode(byte[] byteData, int nLength) |
+ | { | ||
+ | DNSHeader dnsHeader | ||
+ | TreeNode dnsNode = new TreeNode(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | dnsNode.Nodes.Add(" | ||
+ | return dnsNode; | ||
+ | } | ||
+ | private void OnAddTreeNode(TreeNode node) | ||
+ | { | ||
+ | treeView.Nodes.Add(node); | ||
+ | } | ||
- | //zeby przechwytywaæ pakiety z socketu musi to byæ tzw raw socket, | + | private void SnifferForm_Load(object sender, EventArgs e) |
+ | { | ||
+ | string strIP = null; | ||
+ | IPHostEntry hostEntry = Dns.GetHostEntry(Dns.GetHostName()); | ||
- | //w tym przypadku potrzebujemy interfejsu który ma adres IP jest w podsieci i mozemy // | + | if (hostEntry.AddressList.Length > 0) |
+ | { | ||
+ | foreach (IPAddress ip in hostEntry.AddressList) | ||
+ | { | ||
+ | strIP = ip.ToString(); | ||
+ | cmbInterfaces.Items.Add(strIP); | ||
+ | } | ||
+ | } | ||
+ | } | ||
+ | private void SnifferForm_FormClosing(object sender, FormClosingEventArgs e) | ||
+ | { | ||
+ | if (bContinueCapturing) | ||
+ | { | ||
+ | mainSocket.Close(); | ||
+ | } | ||
+ | } | ||
- | mainSocket = new Socket(AddressFamily.InterNetwork, | + | private void treeView_AfterSelect(object sender, TreeViewEventArgs e) { } |
- | + | ||
- | SocketType.Raw, | + | |
- | + | ||
- | // | + | |
- | + | ||
- | mainSocket.Bind(new IPEndPoint(IPAddress.Parse(cmbInterfaces.Text), | + | |
- | + | ||
- | + | ||
- | //kilka opcji | + | |
- | + | ||
- | mainSocket.SetSocketOption(SocketOptionLevel.IP, | + | |
- | + | ||
- | SocketOptionName.HeaderIncluded, | + | |
- | + | ||
- | true); // | + | |
- | + | ||
- | + | ||
- | byte[] byTrue = new byte[4] | + | |
- | + | ||
- | byte[] byOut = new byte[4]{1, 0, 0, 0}; // | + | |
- | + | ||
- | + | ||
- | // | + | |
- | + | ||
- | mainSocket.IOControl(IOControlCode.ReceiveAll, | + | |
- | + | ||
- | byTrue, | + | |
- | + | ||
- | byOut); | + | |
- | + | ||
- | + | ||
- | // | + | |
- | + | ||
- | mainSocket.BeginReceive(byteData, | + | |
- | + | ||
- | new AsyncCallback(OnReceive), | + | |
+ | private void label1_Click(object sender, EventArgs e) { } | ||
+ | } | ||
} | } | ||
- | else | ||
- | |||
- | { | ||
- | |||
- | btnStart.Text = "& | ||
- | |||
- | bContinueCapturing = false; | ||
- | |||
- | //po zakonczeniu przechwytywania zamknij socket | ||
- | |||
- | mainSocket.Close (); | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | catch (Exception ex) //je¿eli bed¹ jakieœ b³êdy to wyœwietlij okienko | ||
- | |||
- | { | ||
- | |||
- | MessageBox.Show(ex.Message, | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void OnReceive(IAsyncResult ar) | ||
- | |||
- | { | ||
- | |||
- | try | ||
- | |||
- | { | ||
- | |||
- | int nReceived = mainSocket.EndReceive(ar); | ||
- | |||
- | |||
- | //Analiza przychodzacych bajtów | ||
- | |||
- | ParseData (byteData, nReceived); | ||
- | |||
- | |||
- | if (bContinueCapturing) | ||
- | |||
- | { | ||
- | |||
- | byteData = new byte[4096]; | ||
- | |||
- | //kolejne przyzwanie begin receive zebyœmy nie przerywali sluchania | ||
- | |||
- | mainSocket.BeginReceive(byteData, | ||
- | |||
- | new AsyncCallback(OnReceive), | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | catch (ObjectDisposedException) | ||
- | |||
- | { | ||
- | |||
- | } | ||
- | |||
- | catch (Exception ex) | ||
- | |||
- | { | ||
- | |||
- | MessageBox.Show(ex.Message, | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void ParseData(byte[] byteData, int nReceived) | ||
- | |||
- | { | ||
- | |||
- | TreeNode rootNode = new TreeNode(); | ||
- | |||
- | |||
- | //wszystkie protokoly sa enkasulowane w pakiecie IP | ||
- | |||
- | //wiec zaczynamy parsowac header IP | ||
- | |||
- | IPHeader ipHeader = new IPHeader(byteData, | ||
- | |||
- | |||
- | TreeNode ipNode = MakeIPTreeNode(ipHeader); | ||
- | |||
- | rootNode.Nodes.Add(ipNode); | ||
- | |||
- | |||
- | //potem parsujemy pole dane datagramu ip | ||
- | |||
- | switch (ipHeader.ProtocolType) | ||
- | |||
- | { | ||
- | |||
- | case Protocol.TCP: | ||
- | |||
- | |||
- | TCPHeader tcpHeader = new TCPHeader(ipHeader.Data, | ||
- | |||
- | ipHeader.MessageLength);// | ||
- | |||
- | |||
- | TreeNode tcpNode = MakeTCPTreeNode(tcpHeader); | ||
- | |||
- | |||
- | rootNode.Nodes.Add(tcpNode); | ||
- | |||
- | |||
- | //jezeli port to 53 to mamy do czynienia z DNSem | ||
- | |||
- | if (tcpHeader.DestinationPort == " | ||
- | |||
- | { | ||
- | |||
- | TreeNode dnsNode = MakeDNSTreeNode(tcpHeader.Data, | ||
- | |||
- | rootNode.Nodes.Add(dnsNode); | ||
- | |||
- | } | ||
- | |||
- | |||
- | break; | ||
- | |||
- | |||
- | case Protocol.UDP: | ||
- | |||
- | |||
- | UDPHeader udpHeader = new UDPHeader(ipHeader.Data, | ||
- | |||
- | (int)ipHeader.MessageLength);// | ||
- | |||
- | |||
- | TreeNode udpNode = MakeUDPTreeNode(udpHeader); | ||
- | |||
- | |||
- | rootNode.Nodes.Add(udpNode); | ||
- | |||
- | |||
- | //jezeli port to 53 to mamy do czynienia z DNSem | ||
- | |||
- | if (udpHeader.DestinationPort == " | ||
- | |||
- | { | ||
- | |||
- | |||
- | TreeNode dnsNode = MakeDNSTreeNode(udpHeader.Data, | ||
- | |||
- | //dlugosc naglowka UDP zawsze 8 bajtów wiec odejmujemy //to od | ||
- | |||
- | //dlugosci calych danych w pakiecie | ||
- | |||
- | Convert.ToInt32(udpHeader.Length) - 8); | ||
- | |||
- | rootNode.Nodes.Add(dnsNode); | ||
- | |||
- | } | ||
- | |||
- | |||
- | break; | ||
- | |||
- | |||
- | case Protocol.Unknown: | ||
- | |||
- | break; | ||
- | |||
- | } | ||
- | |||
- | |||
- | AddTreeNode addTreeNode = new AddTreeNode(OnAddTreeNode); | ||
- | |||
- | |||
- | rootNode.Text = ipHeader.SourceAddress.ToString() + " | ||
- | |||
- | ipHeader.DestinationAddress.ToString(); | ||
- | |||
- | |||
- | //to powoduje te dane sa wyswietlane w postaci takiego wielo zlozonego drzewka | ||
- | |||
- | treeView.Invoke(addTreeNode, | ||
- | |||
- | } | ||
- | |||
- | |||
- | //fukcja która zwraca dane z pakietu IP w formie drzewka | ||
- | |||
- | private TreeNode MakeIPTreeNode(IPHeader ipHeader) | ||
- | |||
- | { | ||
- | |||
- | TreeNode ipNode = new TreeNode(); | ||
- | |||
- | |||
- | ipNode.Text = " | ||
- | |||
- | ipNode.Nodes.Add ("Ver: " + ipHeader.Version); | ||
- | |||
- | ipNode.Nodes.Add (" | ||
- | |||
- | ipNode.Nodes.Add (" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | switch (ipHeader.ProtocolType) | ||
- | |||
- | { | ||
- | |||
- | case Protocol.TCP: | ||
- | |||
- | ipNode.Nodes.Add (" | ||
- | |||
- | break; | ||
- | |||
- | case Protocol.UDP: | ||
- | |||
- | ipNode.Nodes.Add (" | ||
- | |||
- | break; | ||
- | |||
- | case Protocol.Unknown: | ||
- | |||
- | ipNode.Nodes.Add (" | ||
- | |||
- | break; | ||
- | |||
- | } | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | ipNode.Nodes.Add(" | ||
- | |||
- | |||
- | return ipNode; | ||
- | |||
- | } | ||
- | |||
- | |||
- | //fukcja która zwraca dane z pakietu TCP w formie drzewka | ||
- | |||
- | private TreeNode MakeTCPTreeNode(TCPHeader tcpHeader) | ||
- | |||
- | { | ||
- | |||
- | TreeNode tcpNode = new TreeNode(); | ||
- | |||
- | |||
- | tcpNode.Text = " | ||
- | |||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | |||
- | if (tcpHeader.AcknowledgementNumber != "" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | |||
- | if (tcpHeader.UrgentPointer != "" | ||
- | |||
- | tcpNode.Nodes.Add(" | ||
- | |||
- | |||
- | return tcpNode; | ||
- | |||
- | } | ||
- | |||
- | |||
- | //funkcja która zwraca dane z pakietu UDP w formie drzewka | ||
- | |||
- | private TreeNode MakeUDPTreeNode(UDPHeader udpHeader) | ||
- | |||
- | { | ||
- | |||
- | TreeNode udpNode = new TreeNode(); | ||
- | |||
- | |||
- | udpNode.Text = " | ||
- | |||
- | udpNode.Nodes.Add(" | ||
- | |||
- | udpNode.Nodes.Add(" | ||
- | |||
- | udpNode.Nodes.Add(" | ||
- | |||
- | udpNode.Nodes.Add(" | ||
- | |||
- | return udpNode; | ||
- | |||
- | } | ||
- | |||
- | |||
- | //funkcja która zwraca dane z pakietu DNS w formie drzewka | ||
- | |||
- | private TreeNode MakeDNSTreeNode(byte[] byteData, int nLength) | ||
- | |||
- | { | ||
- | |||
- | DNSHeader dnsHeader = new DNSHeader(byteData, | ||
- | |||
- | |||
- | TreeNode dnsNode = new TreeNode(); | ||
- | |||
- | |||
- | dnsNode.Text = " | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | dnsNode.Nodes.Add(" | ||
- | |||
- | |||
- | return dnsNode; | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void OnAddTreeNode(TreeNode node) | ||
- | |||
- | { | ||
- | |||
- | treeView.Nodes.Add(node); | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void SnifferForm_Load(object sender, EventArgs e) | ||
- | |||
- | { | ||
- | |||
- | string strIP = null; | ||
- | |||
- | |||
- | IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName())); | ||
- | |||
- | if (HosyEntry.AddressList.Length > 0) | ||
- | |||
- | { | ||
- | |||
- | foreach (IPAddress ip in HosyEntry.AddressList) | ||
- | |||
- | { | ||
- | |||
- | strIP = ip.ToString(); | ||
- | |||
- | cmbInterfaces.Items.Add(strIP); | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void SnifferForm_FormClosing(object sender, FormClosingEventArgs e) | ||
- | |||
- | { | ||
- | |||
- | if (bContinueCapturing) | ||
- | |||
- | { | ||
- | |||
- | mainSocket.Close(); | ||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | |||
- | private void treeView_AfterSelect(object sender, TreeViewEventArgs e) | ||
- | |||
- | { | ||
- | |||
- | |||
- | } | ||
- | |||
- | |||
- | private void label1_Click(object sender, EventArgs e) | ||
- | |||
- | { | ||
- | |||
- | |||
- | } | ||
- | |||
- | } | ||
- | |||
- | } | ||
</ | </ | ||