问题描述
我正在尝试解析 pcap 以获取有效负载中仅 TLS 记录层的数据包字节。 在我下面的代码中,我设法只从包含 TLS 记录层的有效负载中获取了 tcp 协议字节。我想进一步从中提取 TLS 记录层字节。 你能告诉我如何修改我的代码以仅提取有效载荷的那部分吗?
void got_packet(u_char *args,const struct pcap_pkthdr *header,const u_char *packet){
static int count = 1; /* packet counter */
/* declare pointers to packet headers */
const struct ether_header *ethernet; /* The ethernet header [1] */
const struct ip *ip; /* The IP header */
const struct tcphdr *tcp; /* The TCP header */
const struct sniff_udp *udp; /* The UDP header */
const char *payload; /* Packet payload */
int size_ip;
int size_tcp;
int size_udp;
int size_payload;
printf("\nPacket number %d:\n",count);
count++;
/* define ethernet header */
ethernet = (struct ether_header*)(packet);
/* define/compute ip header offset */
ip = (struct iP*)(packet + sizeof(struct ether_header));
size_ip = sizeof(struct ip);
if (size_ip < 20) {
//printf(" * Invalid IP header length: %u bytes\n",size_ip);
return;
}
/* print source and destination IP addresses */
printf(" From: %s\n",inet_ntoa(ip->ip_src));
printf(" To: %s\n",inet_ntoa(ip->ip_dst));
/* determine protocol */
switch(ip->ip_p) {
case IPPROTO_TCP:
printf(" Protocol: TCP\n");
break;
case IPPROTO_UDP:
printf(" Protocol: UDP\n");
break;
case IPPROTO_ICMP:
printf(" Protocol: ICMP\n");
return;
case IPPROTO_IP:
printf(" Protocol: IP\n");
return;
default:
printf(" Protocol: unkNown\n");
return;
}
/*
* OK,this packet is TCP.
*/
/* define/compute tcp header offset */
if(ip->ip_p == IPPROTO_TCP)
{
tcp = (struct tcphdr *)(packet + sizeof(struct ether_header) + sizeof(struct ip));
size_tcp = sizeof(struct tcphdr);
printf(" Src port: %d\n",ntohs(tcp->th_sport));
printf(" Dst port: %d\n",ntohs(tcp->th_dport));
int sport = ntohs(tcp->th_sport);
int dport = ntohs(tcp->th_dport);
/* define/compute tcp payload (segment) offset */
payload = (u_char *)(packet + sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
/* compute tcp payload (segment) size */
size_payload = header->len - (sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
/*
* Print payload data; it might be binary,so don't just
* treat it as a string.
*/
if (size_payload > 0) {
printf(" Payload (%d bytes):\n",size_payload);
print_payload(payload,size_payload);
//if ((sport == 80) || (dport == 80))
//{
// printf(" HTTP prase:\n");
// prase_http(payload,size_payload);
//}
if(sport == 443 || dport == 443)
{
// printf(" SSL/TLS prase:\n");
//prase_ssl_tls(payload,size_payload);
//printf("%u",payload);
// print_payload(payload,size_payload);
parser(payload,size_payload);
}
}
}
/* UDP */
else if(ip->ip_p == IPPROTO_UDP)
{
udp = (struct sniff_udP*)(packet + SIZE_ETHERNET + size_ip);
size_udp = 8;
printf(" Src port: %d\n",ntohs(udp->uh_sport));
printf(" Dst port: %d\n",ntohs(udp->uh_dport));
int sport = ntohs(udp->uh_sport);
int dport = ntohs(udp->uh_dport);
payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_udp);
size_payload = ntohs(ip->ip_len) - (size_ip + size_udp);
if (size_payload > 0) {
//printf(" Payload (%d bytes:)\n",size_payload);
if(sport == 53 || dport == 53)
{
// printf(" DNS prase:\n");
// prase_dns(payload,size_payload);
}
}
}
return;
}
这是作为参数传递给 pcap_loop 的 got_packet 函数,它是
我想提取数据包的这一部分(附上图片链接): Screenshot from wireshark as to what I wish to parse
有人可以帮我解决这个问题吗?
解决方法
暂无找到可以解决该程序问题的有效方法,小编努力寻找整理中!
如果你已经找到好的解决方法,欢迎将解决方案带上本链接一起发送给小编。
小编邮箱:dio#foxmail.com (将#修改为@)