基于winpcap数据抓取、分析软件系统.docVIP

本科毕业论文 基于winpcap数据抓取系统 学 院： 计算机与信息工程学院 专 业： 计算机科学与技术 学 号： 071015559 姓 名： 指导教师： 职 称： 论文提交日期： 摘 要 WinPcap 是win32 平台下用于原始数据包捕获，向网络发送数据报文，搜集网络通信过程中统计信息的重要工具。著名的网络封包分析软件Wireshark（前身是Ethereal）就是依靠WinPcap 提供的接口实现的数据包捕获。本文简要介绍了WinPcap 的历史和Winpcap 的体系结构及内部结构，然后讨论了WinPcap 对网络数据包过滤的机制及特性通过VC++6.0中MFC编程实现通过一个完整界面来控制调用中的函数来实现对网卡信息的捕获和循环捕获数据包，然后通过预先对于IP、TCP、UDP等数据包的定义和TCP/IP等协议来解析其中包含的内容并返回显示捕获到数据包的信息，当然也可以保存捕获到的数据包到指定地点以便进一步分析。Winpcap 捕获 分析 TCP/IP 数据包 Abstract WinPcap is an important tool for raw packet capture, sending packets to the network andcollecting network traffic statistic. The well－known network analysis software – Wireshark（formerlyEhtereal） is rely on Winpcap to realize the function of capture. This introduces the history ofWinpcap open source project and the Winpcap architecture and internal structure, and then given themethod of building a network protocol analysis development environment with WinPcap and VC,focusing on the WinPcap packet filtering mechanisms and characteristics, and analyze theshortcomings of packet filtering on Winpcap and the error－prone areas of the preparation of WinPcapfilter string. Finally, solutions and solution were evaluated. By VC + +6.0 MFC programming in the full interface to control through a call to the function to achieve Winpcap card information on the capture and recycling capture packets, and then advance the IP, TCP, UDP and other data structure definitions and TCP /IP and other protocols to resolve them and return the display contains the contents of the captured packets of information, of course, you can save the captured data packets to the designated location for further analysis.  Key words: Winpcap Capture Analysis TCP / IP Data packets 目 录 1 绪论 1 1.1?课题背景 1 1.1.1WinPcap 介绍..................................................1 1.1.2 WinPcap 体系结构.................................