我在用libpcap分析从caida下载的流量文件equinix-nyc.dirA.20180419-125909.UTC.anon.pcap, 希望打印出其中的TCP数据包的流标识符. 我的分析程序如下:

 //解析.c
#include <pcap.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <翻译包.h>void packetHandler(u_char *userData, const struct pcap_pkthdr* pkthdr, const u_char* packet);int main() {pcap_t *descr;char errbuf[PCAP_ERRBUF_SIZE];// open capture file for offline processingchar 文件名[] = "/Users/zongyi/traces/caida/equinix-nyc.dirA.20180419-125909.UTC.anon.pcap";descr = pcap_open_offline(文件名, errbuf);if (descr == NULL) {printf("pcap_open_offline() failed: %s\n", errbuf);return 1;}// start packet processing loop, just like live capture_整数_ 数据包数 = 100; // 如果设为0, 则会遍历文件中的所有数据包if (pcap_loop(descr, 数据包数, packetHandler, NULL) < 0) {printf("pcap_loop() failed\n");return 1;}printf("capture finished\n");pcap_close(descr);return 0;
}void packetHandler(u_char *userData, const struct pcap_pkthdr* pkthdr, const u_char* packet) {const struct ether_header* ethernetHeader;const struct ip* ipHeader;const struct tcphdr* tcpHeader;char sourceIp[INET_ADDRSTRLEN];char destIp[INET_ADDRSTRLEN];u_int sourcePort, destPort;u_char *data;int dataLength = 0;ethernetHeader = (struct ether_header*) packet;if (ntohs(ethernetHeader->ether_type) == ETHERTYPE_IP) {ipHeader = (struct ip*)(packet + sizeof(struct ether_header));inet_ntop(AF_INET, &(ipHeader->ip_src), sourceIp, INET_ADDRSTRLEN);inet_ntop(AF_INET, &(ipHeader->ip_dst), destIp, INET_ADDRSTRLEN);if (ipHeader->ip_p == IPPROTO_TCP) {tcpHeader = (struct tcphdr*)(packet + sizeof(struct ether_header) + sizeof(struct ip));_正整数_ 源地址 = ntohl(ipHeader->ip_src.s_addr);_正整数_ 目标地址 = ntohl(ipHeader->ip_dst.s_addr);sourcePort = ntohs(tcpHeader->th_sport);destPort = ntohs(tcpHeader->th_dport);_正整数_ 确认号 = ntohl(tcpHeader->th_ack);_正整数_ 序列号 = ntohl(tcpHeader->th_seq);_输出("源地址:%u\t目标地址:%u\t源端口号:%5u\t目标端口号:%5u\t序列号:%u\t确认号:%u\n", \源地址, 目标地址, sourcePort, destPort, 序列号, 确认号);}}
}

运行命令如下:

g++ 解析.cpp -o a.out -lpcap
./a.out

但是没有得到任何输出. 

通过在网上搜索资料, 我发现CAIDA的流量文件并不包含以太网包头, 而是直接包含了IP包, 因此如果首先对以太网包头进行匹配就会发生错误. 基于这一认识, 我们可以修改以上程序如下:

 //解析.c
#include <pcap.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <翻译包.h>void packetHandler(u_char *userData, const struct pcap_pkthdr* pkthdr, const u_char* packet);int main() {pcap_t *descr;char errbuf[PCAP_ERRBUF_SIZE];// open capture file for offline processingchar 文件名[] = "/Users/zongyi/traces/caida/equinix-nyc.dirA.20180419-125909.UTC.anon.pcap";descr = pcap_open_offline(文件名, errbuf);if (descr == NULL) {printf("pcap_open_offline() failed: %s\n", errbuf);return 1;}// start packet processing loop, just like live capture_整数_ 数据包数 = 10; // 如果设为0, 则会遍历文件中的所有数据包if (pcap_loop(descr, 数据包数, packetHandler, NULL) < 0) {printf("pcap_loop() failed\n");return 1;}printf("capture finished\n");pcap_close(descr);return 0;
}void packetHandler(u_char *userData, const struct pcap_pkthdr* pkthdr, const u_char* packet) {const struct ether_header* ethernetHeader;const struct ip* ipHeader;const struct tcphdr* tcpHeader;char sourceIp[INET_ADDRSTRLEN];char destIp[INET_ADDRSTRLEN];u_int sourcePort, destPort;u_char *data;int dataLength = 0;ipHeader = (struct ip*) packet;inet_ntop(AF_INET, &(ipHeader->ip_src), sourceIp, INET_ADDRSTRLEN);inet_ntop(AF_INET, &(ipHeader->ip_dst), destIp, INET_ADDRSTRLEN);if (ipHeader->ip_p == IPPROTO_TCP) {tcpHeader = (struct tcphdr*)(packet + sizeof(struct ether_header) + sizeof(struct ip));_正整数_ 源地址 = ntohl(ipHeader->ip_src.s_addr);_正整数_ 目标地址 = ntohl(ipHeader->ip_dst.s_addr);sourcePort = ntohs(tcpHeader->th_sport);destPort = ntohs(tcpHeader->th_dport);_正整数_ 确认号 = ntohl(tcpHeader->th_ack);_正整数_ 序列号 = ntohl(tcpHeader->th_seq);_输出("源地址:%u\t目标地址:%u\t源端口号:%5u\t目标端口号:%5u\t序列号:%u\t确认号:%u\n", \源地址, 目标地址, sourcePort, destPort, 序列号, 确认号);}
}

其输出结果如下: