SharpPcap开发全攻略(英文版)

CONTENTSIntroduction.............................................................................................................................................2Background..............................................................................................................................................2AboutSharpPcap.....................................................................................................................................3Packet.Netarchitectureandusage..........................................................................................................4SharpPcaptutorial:AstepbystepguidetousingSharpPcap.................................................................6Obtainingthedevicelist(Example1inthesourcepackage)..................................................................6Openinganadapterandcapturingpackets(Example3inthesourcepackage).....................................8Capturingpacketswithouttheeventhandler(Example4inthesourcepackage)...............................10Filteringthetraffic(Example5inthesourcepackage).........................................................................11Interpretingthepackets(Example6inthesourcepackage)................................................................12Handlingofflinedumpfiles(Example8inthesourcepackage)...........................................................14Sendingpackets(Example9inthesourcepackage).............................................................................17Gatheringstatisticsonthenetworktraffic-WinPcaponly(Example11inthesourcepackage).........21References.............................................................................................................................................23History...................................................................................................................................................23Eg:..........................................................................................................................................................242/32[A.NETsnifferapplicationwrittenwithSharpPcap]IntroductionPacketcapturing(orpacketsniffing)istheprocessofcollectingallpacketsofdatathatpassthroughagivennetworkinterface.Capturingnetworkpacketsinourapplicationsisapowerfulcapabilitywhichletsuswritenetworkmonitoring,packetanalyzersandsecuritytools.ThelibpcaplibraryforUNIXbasedsystemsandWinPcapforWindowsarethemostwidelyusedpacketcapturedriversthatprovideAPIforlow-levelnetworkmonitoring.Amongtheapplicationsthatuselibpcap/WinPcapasitspacketcapturesubsystemarethefamoustcpdumpandWireshark.Inthisarticle,wewillintroducetheSharpPcap.NETassembly(library)forinterfacingwithlibpcaporwinpcapfromyour.NETapplicationandwillgiveyouadetailedprogrammingtutorialonhowtouseit.BackgroundTamirGalstartedtheSharpPcapprojectaround2004.HewantedtouseWinPcapina.NETapplicationwhileworkingonhisfinalprojectforuniversity.TheprojectinvolvedanalyzinganddecodingVoIPtrafficandhewantedtokeepcodingsimplewithC#whichhastimesavingfeatureslikegarbagecollection.AccessingtheWinPcapAPIfrom.NETseemedtobequiteapopularrequirement,andhefoundsomeusefulprojectsonCodeProject'swebsitethatletyoudojustthat:oPacketCaptureandAnalayzeroRawSocketCapturingUsingC#oPacketsniffingwithwinpcapfunctionsportedtoa.NETlibrary3/32Thefirstprojectisagreatethereal.NETclonethatletsyoucaptureandanalyzenumeroustypesofprotocolpackets.However,afewissueswiththisprojectmakeitalmostimpossibletobesharedamongother.NETapplications.Firstly,theauthordidnotprovideanygenericAPIforcapturingpacketsthatcanbeusedbyother.NETapplications.Hedidn'tseparatehisUIcodeandhisanalyzingandcapturingcode,makinghiscapturingcodedependontheGUIclassessuchasListViewtooperate.Secondly,forsomereasontheauthorchosetore-implementsomeofWinPcap'sfunctionsinC#byhimselfratherthanjustwrappingthem.Thismeansthathisapplicationcan'ttakeadvantageofthenewWinPcapversionssincehehardcodedacertainversionofWinPcapinhisapplication.ThesecondandthethirdarticlesarenicestartsforwrapperprojectsforWinPcap,howevertheydidn'tprovidesomeimportantWinPcapfeaturessuchashandlingofflinepcapfilesandapplyingkernel-levelpacketfilters,andmostimportantlytheyprovidenoparserclassesforanalyzingprotocolpackets.Bothprojectsdidn'tposttheirlibrarysourcecodetogetherwiththearticleinordertoletotherpeopleextendtheirworkandaddnewfeaturesandnewpacketparserclasses.Andso,Tamirdecidedtostarthisownlibraryforthetask.Severalversionsinthe1.xserieswerereleased.Developmentslowedtowardsmid-2007whenthelastversioninthe1.xserieswasreleased,SharpPcap1.6.2.ChrisMorgantookoverdevelopmentofSharpPcapinNovemberof2008.SincethenSharpPcaphashadmajorinternalrewritesandAPIimprovements.InlateFebruary2010SharpPcapv3.0wasreleased.ThisreleaserepresentsarewriteofSharpPcap'spacketparsers.Packetparsingfunctionalitywasbrokenoutintoanewlibrary,Packet.Net.SharpPcaptakescareofinterfacingwithlibpcap/winpcapandPacket.Nettakescareofpacketdissectionandcreation.ThedetailsofPacket.Net'sarchitecturewillbediscussedlaterintheturotial.AboutSh