使用sharppcap抓数据包.docxVIP

使用sharppcap抓数据包首先用到PacketDotNet,SharpPcap这两个DLL,工具Ethereal可以分析包内容class Program {staticboolshowDetails = false; //查看详情的参数privatestaticboolBackgroundThreadStop = false; //线程停止标识privatestaticobjectQueueLock = newobject(); //线程锁变量privatestatic ListPacketDotNet.RawPacket PacketQueue = new ListPacketDotNet.RawPacket(); //待处理数据包队列staticvoid Main(string[] args) {//显示SharpPcap版本stringver = SharpPcap.Version.VersionString;Console.WriteLine(SharpPcap {0}, ver);//获取网络设备var devices = LivePcapDeviceList.Instance;if (devices.Count 1) {Console.WriteLine(找不到网络设备);return; }Console.WriteLine();Console.WriteLine(以下是目前本计算机上的活动网络设备:);Console.WriteLine(----------------------------------------------------);Console.WriteLine();inti = 0;foreach (LivePcapDevicedevin devices) {Console.WriteLine({0}) {1} {2}, i, dev.Name, dev.Description);i++; }//选择要监听的网络设备Console.WriteLine();Console.WriteLine(--选择一个需要监听的网络设备--);i = int.Parse(Console.ReadLine());LivePcapDevice device = devices[i];Console.Write(-- 请选择操作：监听通讯[C/c]，多线程监听通讯[T/t]，监听统计[F/f]，发送随机数据包[S/s]? );stringresp = Console.ReadLine().ToUpper();while (!(resp.StartsWith(C) || resp.StartsWith(F) || resp.StartsWith(T) || resp.StartsWith(S))) {resp = Console.ReadLine().ToUpper(); }try {if (resp.StartsWith(C) || resp.StartsWith(F) || resp.StartsWith(T)) {//监听过滤条件string filter = ip and tcp;//连接设备System.Threading.ThreadbackgroundThread = null;intreadTimeoutMilliseconds = 1000;if (resp.StartsWith(F)) {device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);device.Filter=filter;device.Mode = CaptureMode.Statistics; //抓包统计device.OnPacketArrival+= newPacketArrivalEventHandler(device_OnPacketArrival); //抓数据包回调事件device.OnPcapStatistics += newStatisticsModeEventHandler(device_OnPcapStatistics); //抓包统计回调事件 }elseif (resp.StartsWith(C)) {device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);devi