C# 网络抓包 数据分析 Demo源码(PacketNet)

【实例截图】

【核心代码】

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using SharpPcap;
using PacketDotNet;
using PacketDotNet.Ieee80211;
using SharpPcap.AirPcap;

namespace CapturingAndParsingWiFiPackets
{
    class MainClass
    {
        // used to stop the capture loop
        private static bool stopCapturing = false;

        public static void Main (string[] args)
        {
            // Print SharpPcap version
            string ver = SharpPcap.Version.VersionString;
            Console.WriteLine ("PacketDotNet example using SharpPcap {0}", ver);

            // Retrieve the device list
            var devices = AirPcapDeviceList.Instance;

            // If no devices were found print an error
            if (devices.Count < 1)
            {
                Console.WriteLine ("No devices were found on this machine");
                return;
            }

            Console.WriteLine ();
            Console.WriteLine ("The following devices are available on this machine:");
            Console.WriteLine ("----------------------------------------------------");
            Console.WriteLine ();

            int i = 0;

            // Print out the devices
            foreach (var dev in devices)
            {
                /* Description */
                Console.WriteLine ("{0}) {1} {2}", i, dev.Name, dev.Description);
                i  ;
            }

            Console.WriteLine ();
            Console.Write ("-- Please choose a device to capture: ");
            i = int.Parse (Console.ReadLine ());

            // Register a cancle handler that lets us break out of our capture loop
            // since we currently need to synchronously receive packets in order to get
            // raw packets. Future versions of SharpPcap are likely to
            // return ONLY raw packets at which time we can simplify this code and
            // use a PcapDevice.OnPacketArrival handler
            Console.CancelKeyPress  = HandleCancelKeyPress;

            var device = (AirPcapDevice)devices [i];

            // Open the device for capturing
            int readTimeoutMilliseconds = 1000;
            device.Open (DeviceMode.Promiscuous, readTimeoutMilliseconds);
            device.FcsValidation = AirPcapValidationType.ACCEPT_CORRECT_FRAMES;

            Console.WriteLine ();
            Console.WriteLine ("-- Listening on {0}, hit 'ctrl-c' to stop...",
                device.Name);

            while (stopCapturing == false)
            {
                var rawCapture = device.GetNextPacket ();

                // null packets can be returned in the case where
                // the GetNextRawPacket() timed out, we should just attempt
                // to retrieve another packet by looping the while() again
                if (rawCapture == null)
                {
                    // go back to the start of the while()
                    continue;
                }

                // use PacketDotNet to parse this packet and print out
                // its high level information
                Packet p = Packet.ParsePacket (rawCapture.LinkLayerType, rawCapture.Data);
                MacFrame macFrame = (MacFrame)p.PayloadPacket;
                if ((macFrame != null) && 
                    (macFrame.FrameControl.SubType == FrameControlField.FrameSubTypes.ManagementBeacon))
                {
                    BeaconFrame beaconFrame = (BeaconFrame)macFrame;
                    var ie = beaconFrame.InformationElements.FindFirstById(InformationElement.ElementId.ServiceSetIdentity);
                    Console.WriteLine ("Network: {0}, Access Point Address: {1}", Encoding.UTF8.GetString (ie.Value), beaconFrame.SourceAddress);       
                }
            }

            Console.WriteLine ("-- Capture stopped");

            // Print out the device statistics
            Console.WriteLine (device.Statistics.ToString ());

            // Close the pcap device
            device.Close ();
        }

        static void HandleCancelKeyPress(object sender, ConsoleCancelEventArgs e)
        {
            Console.WriteLine("-- Stopping capture");
            stopCapturing = true;

            // tell the handler that we are taking care of shutting down, don't
            // shut us down after we return because we need to do just a little
            // bit more processing to close the open capture device etc
            e.Cancel = true;
        }
    }
}