拦截网络数据包（SOCK_RAW）

#include <winsock2.h>#include <ws2tcpip.h>#include <iostream>using namespace std;#pragma comment(lib, "ws2_32.lib")#define BUFFER_SIZE 1024#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)typedef struct _TCP //应用层，传输层层{WORD SrcPort; // 源端口WORD DstPort; // 目的端口DWORD SeqNum; // 顺序号DWORD AckNum; // 确认号BYTE DataOff; // TCP头长BYTE Flags; // 标志（URG、ACK等）WORD Window; // 窗口大小WORD Chksum; // 校验和WORD UrgPtr; // 紧急指针} TCP;typedef TCP *LPTCP;typedef TCP UNALIGNED * ULPTCP;typedef struct _IP //传输层，网络层{union{ BYTE Version; // 版本 BYTE HdrLen; // IHL};BYTE ServiceType; // 服务类型WORD TotalLen; // 总长WORD ID; // 标识union{ WORD Flags; // 标志 WORD FragOff; // 分段偏移};BYTE TimeToLive; // 生命期BYTE Protocol; // 协议WORD HdrChksum; // 头校验和DWORD SrcAddr; // 源地址DWORD DstAddr; // 目的地址BYTE Options; // 选项} IP;typedef IP * LPIP;typedef IP UNALIGNED * ULPIP;#define PROTOCOL_STRING_ICMP_TXT "ICMP"#define PROTOCOL_STRING_TCP_TXT "TCP"#define PROTOCOL_STRING_UDP_TXT "UDP"#define PROTOCOL_STRING_SPX_TXT "SPX"#define PROTOCOL_STRING_NCP_TXT "NCP"#define PROTOCOL_STRING_UNKNOW_TXT "UNKNOW"char* GetProtocolTxt(int Protocol){switch (Protocol){case IPPROTO_ICMP : //1 return PROTOCOL_STRING_ICMP_TXT;case IPPROTO_TCP : //6 return PROTOCOL_STRING_TCP_TXT;case IPPROTO_UDP : //17 return PROTOCOL_STRING_UDP_TXT;default: return PROTOCOL_STRING_UNKNOW_TXT;}}//*.cppvoid main(){WSADATA wsadata;// 检查 Winsock 版本号，WSAData为WSADATA结构对象int erro=WSAStartup(MAKEWORD(1, 1), &wsadata);if(erro!=0){ cout<<"初始化失败"<<endl; return ;}// 创建原始套接字SOCKET sock;sock = socket(AF_INET, SOCK_RAW, IPPROTO_IP);// 设置IP头操作选项，其中flag 设置为ture，亲自对IP头进行处理BOOL flag=TRUE;setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char*)&flag, sizeof(flag));// 获取本机名char LocalName[512];gethostname((char*)LocalName, sizeof(LocalName)-1);// 获取本地 IP 地址hostent * pHost;pHost=gethostbyname((char*)LocalName);// 填充SOCKADDR_IN结构SOCKADDR_IN addr_in;addr_in.sin_addr= *(in_addr *)pHost->h_addr;//h_addr_list[0]; //IP h_addr定义的宏addr_in.sin_family = AF_INET;addr_in.sin_port = htons(1004);// 把原始套接字sock 绑定到本地网卡地址上bind(sock, (PSOCKADDR)&addr_in, sizeof(addr_in));// dwValue为输入输出参数，为1时执行，0时取消DWORD dwValue = 1;// 设置 SOCK_RAW 为SIO_RCVALL，以便接收所有的IP包。其中SIO_RCVALL// 的定义为： #define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)ioctlsocket(sock, SIO_RCVALL, &dwValue); //将网卡设置为混合模式 char RecvBuf[BUFFER_SIZE];IP ip;TCP tcp;while (true){ // 接收原始数据包信息 int ret = recv(sock, RecvBuf, BUFFER_SIZE, 0); if (ret !=0) { // 对数据包进行分析，并输出分析结果 ip = *(IP*)RecvBuf; tcp = *(TCP*)(RecvBuf + ip.HdrLen); cout<<"协议"<<GetProtocolTxt(ip.Protocol)<<endl; cout<<"IP源地址"<<inet_ntoa(*(in_addr*)&ip.SrcAddr)<<endl; cout<<"IP目标地址"<<inet_ntoa(*(in_addr*)&ip.DstAddr)<<endl; cout<<"TCP源端口号"<<tcp.SrcPort<<endl; cout<<"TCP目标端口号"<<tcp.DstPort<<endl; cout<<"数据包长度"<<ntohs(ip.TotalLen)<<endl; //cout<<(char *)(RecvBuf+sizeof(ip)+sizeof(tcp)); //cout<<(char *)(RecvBuf+28)<<endl; }}}

转自：http://hi.baidu.com/gm123092267/blog/item/93a4583a5de63af8b311c7ce.html