|
Raw Socket（原始套接字）实现Sniffer（嗅探）(2) 越来越发现 Sniffer 原来如此的简单了, 这么一个函数就已经完成抓取数据包的任务了. 四. 分析数据包
这回抓来的包和平常用 Socket 接受的包可就不是一回事儿了, 里面包含 IP, TCP 等原始信息. 要分析它首先得知道这些结构.
数据包的总体结构:
----------------------------------------------
ip header tcp header(or x header) data
---------------------------------------------- IP header strUCture:
4 8 16 32 bit
----------------------------------------------------------------
Ver IHL Type of service Total length
----------------------------------------------------------------
Identification Flags Fragment offset
----------------------------------------------------------------
Time to live Protocol Header checksum
----------------------------------------------------------------
Source address
----------------------------------------------------------------
Destination address
----------------------------------------------------------------
Option + Padding
----------------------------------------------------------------
Data
---------------------------------------------------------------- TCP header structure:
16 32 bit
----------------------------------------------------------------
Source port Destination port
----------------------------------------------------------------
Sequence number
| 
