SharpPcap - 數據包捕獲獲取messesge問題

我試圖使用SharpPcap庫捕獲數據包。我能夠返回數據包的詳細信息，但我有問題要獲取數據包內的消息內容。SharpPcap - 數據包捕獲獲取messesge問題

該數據包使用.Data返回消息，當我使用它時它返回（System.Byte []）。

這裏是圖書館網站： http://www.codeproject.com/KB/IP/sharppcap.aspx

這裏是我的代碼：

string packetData; 
     private void packetCapturingThreadMethod() 
      { 

      Packet packet = null; 
      int countOfPacketCaptures = 0; 

      while ((packet = device.GetNextPacket()) != null) 
       { 

       packet = device.GetNextPacket(); 
       if (packet is TCPPacket) 
        { 
        TCPPacket tcp = (TCPPacket)packet; 
        myPacket tempPacket = new myPacket(); 

        tempPacket.packetType = "TCP"; 
        tempPacket.sourceAddress = Convert.ToString(tcp.SourceAddress); 
        tempPacket.destinationAddress = Convert.ToString(tcp.DestinationAddress); 
        tempPacket.sourcePort = Convert.ToString(tcp.SourcePort); 
        tempPacket.destinationPort = Convert.ToString(tcp.DestinationPort); 
        tempPacket.packetMessage = Convert.ToString(tcp.Data); 
        packetsList.Add(tempPacket); 

        packetData = 
         "Type= TCP" + 
         " Source Address = "+ Convert.ToString(tcp.SourceAddress)+ 
         " Destination Address =" +Convert.ToString(tcp.DestinationAddress)+ 
         " SourcePort =" + Convert.ToString(tcp.SourcePort)+ 
         " SourcePort =" +Convert.ToString(tcp.DestinationPort)+ 
         " Messeage =" + Convert.ToString(tcp.Data); 
        txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets), 
      new object[] { packetData }); 


        string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage }; 
        try { //dgwPacketInfo.Rows.Add(row); countOfPacketCaptures++; 
        //lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures); 
        } 
        catch (Exception e) { } 

        } 
       else if (packet is UDPPacket) 
        { 

        UDPPacket udp = (UDPPacket)packet; 


        myPacket tempPacket = new myPacket(); 

        tempPacket.packetType = "UDP"; 
        tempPacket.sourceAddress = Convert.ToString(udp.SourceAddress); 
        tempPacket.destinationAddress = Convert.ToString(udp.DestinationAddress); 
        tempPacket.sourcePort = Convert.ToString(udp.SourcePort); 
        tempPacket.destinationPort = Convert.ToString(udp.DestinationPort); 
        tempPacket.packetMessage = udp.Data.ToArray() + "\n"; 
        packetsList.Add(tempPacket); 

        packetData = 
         "Type= UDP" + 
         " Source Address = "+ Convert.ToString(udp.SourceAddress)+ 
         " Destination Address =" +Convert.ToString(udp.DestinationAddress)+ 
         " SourcePort =" + Convert.ToString(udp.SourcePort)+ 
         " SourcePort =" +Convert.ToString(udp.DestinationPort)+ 
         " Messeage =" + udp.Data.ToArray() + "\n"; 
        string[] row = { packetsList[countOfPacketCaptures].packetType, packetsList[countOfPacketCaptures].sourceAddress, packetsList[countOfPacketCaptures].destinationAddress, packetsList[countOfPacketCaptures].sourcePort, packetsList[countOfPacketCaptures].destinationPort, packetsList[countOfPacketCaptures].packetMessage }; 
        try { 
         //dgwPacketInfo.Rows.Add(row); 
        //countOfPacketCaptures++; 
        //lblCapturesLabels.Text = Convert.ToString(countOfPacketCaptures); 
         txtpackets.Invoke(new UpdatetxtpacketsCallback(this.Updatetxtpackets), 
       new object[] { packetData }); 

        } 
        catch (Exception e) { } 


        } 


       } 
      }

來源

2010-03-24 Eyla

我找到了答案......

數據是一個字節數組，所以我需要使用位轉換器而不是使用：

Convert.ToString(tcp.Data);

我應該用途：

BitConverter.ToString(tcp.Data)

來源

2010-03-24 01:31:20 Eyla

解析器是不是複雜...

我看着Packet.Net代碼（這是SharpPcap解析）和所有領域都存儲在通常使用的格式。

IP地址存儲在System.Net.IPAddress格式中，因此您可以對它們調用.ToString以獲取正確包含點標記的文本字符串。

端口號存儲爲ushort，可以打印爲任何其他整數。

需要以二進制形式解釋的唯一部分是數據字段，因爲它根據正在下一層使用的協議進行更改。 SharpPcap/Packet.Net已經爲您完成了大部分工作，並且字段以最方便或者相同的形式存儲在協議規範中。只需使用intellisense來檢查字段的類型，如果它不是您熟悉的類型（例如System.Net.IPAddress或System.NetworkInformation.PhysicalAddress（對於MAC地址）），只需將其谷歌。

來源

2010-11-10 07:29:16

SharpPcap - 數據包捕獲獲取messesge問題

回答

相關問題