C# SharpPcap-数据包捕获获取消息问题
我正在尝试使用SharpPcap库捕获数据包。 我可以返回数据包的详细信息,但我无法获取数据包中的消息内容 使用.Data返回消息的数据包,当我使用它时,它正在返回(System.Byte[]) 以下是图书馆网站: 这是我的密码:C# SharpPcap-数据包捕获获取消息问题,c#,packet-capture,pcap,C#,Packet Capture,Pcap,我正在尝试使用SharpPcap库捕获数据包。 我可以返回数据包的详细信息,但我无法获取数据包中的消息内容 使用.Data返回消息的数据包,当我使用它时,它正在返回(System.Byte[]) 以下是图书馆网站: 这是我的密码: string packetData; private void packetCapturingThreadMethod() { Packet packet = null; int
string packetData;
private void packetCapturingThreadMethod()
{
Packet packet = null;
int countOfPacketCaptures = 0;
while ((packet = device.GetNextPacket()) != null)
{
packet = device.GetNextPacket();
if (packet is TCPPacket)
{
TCPPacket tcp = (TCPPacket)packet;
myPacket tempPacket = new myPacket();
tempPacket.packetType = "TCP";
tempPacket.sourceAddress = Convert.ToString(tcp.SourceAddress);
tempPacket.destinationAddress = Convert.ToString(tcp.DestinationAddress);
tempPacket.sourcePort = Convert.ToString(tcp.SourcePort);
tempPacket.destinationPort = Convert.ToString(tcp.DestinationPort);
tempPacket.packetMessage = Convert.ToString(tcp.Data);
packetsList.Add(tempPacket);
packetData =
"Type= TCP" +
" Source Address = "+ Convert.ToString(tcp.SourceAddress)+
" Destination Address =" +Convert.ToString(tcp.DestinationAddress)+
" SourcePort =" + Convert.ToString(tcp.SourcePort)+
" SourcePort =" +Convert.ToString(tcp.DestinationPort)+
" Messeage =" + Convert.ToString(tcp.Data);
txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets),
new object[] { packetData });
string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage };
try { //dgwPacketInfo.Rows.Add(row); countOfPacketCaptures++;
//lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures);
}
catch (Exception e) { }
}
else if (packet is UDPPacket)
{
UDPPacket udp = (UDPPacket)packet;
myPacket tempPacket = new myPacket();
tempPacket.packetType = "UDP";
tempPacket.sourceAddress = Convert.ToString(udp.SourceAddress);
tempPacket.destinationAddress = Convert.ToString(udp.DestinationAddress);
tempPacket.sourcePort = Convert.ToString(udp.SourcePort);
tempPacket.destinationPort = Convert.ToString(udp.DestinationPort);
tempPacket.packetMessage = udp.Data.ToArray() + "\n";
packetsList.Add(tempPacket);
packetData =
"Type= UDP" +
" Source Address = "+ Convert.ToString(udp.SourceAddress)+
" Destination Address =" +Convert.ToString(udp.DestinationAddress)+
" SourcePort =" + Convert.ToString(udp.SourcePort)+
" SourcePort =" +Convert.ToString(udp.DestinationPort)+
" Messeage =" + udp.Data.ToArray() + "\n";
string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage };
try {
//dgwPacketInfo.Rows.Add(row);
//countOfPacketCaptures++;
//lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures);
txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets),
new object[] { packetData });
}
catch (Exception e) { }
}
}
}
我找到了答案
数据是字节数组,因此我需要使用位转换器,而不是使用:
Convert.ToString(tcp.Data);
我应该使用:
BitConverter.ToString(tcp.Data)
解析器没有那么复杂… 我查看了Packet.Net代码(这是SharpPcap的解析),所有字段都以常用格式存储 IP地址以System.Net.IPAddress格式存储,因此您只需调用.ToString即可获取正确包含点标记的文本字符串 端口号存储为ushort,可以与任何其他整数一样打印 唯一需要以二进制形式解释的部分是数据字段,因为它会根据上一层使用的协议而变化。SharpPcap/Packet.Net已经为您完成了大部分工作,字段以协议规范中最方便或相同的形式存储。只需使用intellisense检查字段的类型,如果它不是您熟悉的类型(如System.Net.IPAddress或System.NetworkInformation.PhysicalAddress(用于MAC地址)),只需通过谷歌搜索即可