python解析发往本机的数据包示例 (解析数据包)

tcp.py

# -*- coding: cp936 -*-
import socket
from struct import *
from time import ctime,sleep
from os import system

system('title tcp sniffer')
system('color 05')

# the public network interface
host = socket.gethostbyname(socket.gethostname())

# create a raw socket and bind it to the public interface
s = socket.socket(socket.af_inet, socket.sock_raw, socket.ipproto_ip)
s.bind((host, 0))

# include ip headers
s.setsockopt(socket.ipproto_ip, socket.ip_hdrincl, 1)

# receive all packages
#s.ioctl(socket.sio_rcvall, socket.rcvall_on)

# receive a package
while 1==1:
    packet = s.recvfrom(65565)
    packet = packet[0]

    ip_header = packet[0:20]
    iph = unpack('!bbhhhbbh4s4s',ip_header)
    version = iph[0] >> 4 #version
    ihl = iph[0] * 0xf    #ihl
    iph_length = ihl * 4  #total length
    ttl = iph[5]
    protocol = iph[6]
    s_addr = socket.inet_ntoa(iph[8])
    d_addr = socket.inet_ntoa(iph[9])
    print ctime()
    print 'version : ' + str(version) + ' ihl : ' + str(ihl) + ' total length: '+str(iph_length) + ' ttl : ' +str(ttl) + ' protocol : ' + str(protocol) + ' source address : ' + str(s_addr) + ' destination address : ' + str(d_addr)

    if protocol == 6:
        tcp_header = packet[20:40]
        tcph = unpack('!hhllbbhhh' , tcp_header)
        source_port = tcph[0]
        dest_port = tcph[1]
        sequence = tcph[2]
        acknowledgement = tcph[3]
        doff_reserved = tcph[4]
        tcph_length = doff_reserved >> 4
        print 'source port : ' + str(source_port) + ' dest port : ' + str(dest_port) + ' sequence number : ' + str(sequence) + ' acknowledgement : ' + str(acknowledgement) + ' tcp header length : ' + str(tcph_length)

        data = packet[40:len(packet)]
        print 'data : ' + data

# disabled promiscuous mode
s.ioctl(socket.sio_rcvall, socket.rcvall_off)

udp.py

# -*- coding: cp936 -*-
import socket
from struct import *
from time import ctime,sleep
from os import system

system('title udp sniffer')
system('color 05')
# the public network interface
host = socket.gethostbyname(socket.gethostname())

# create a raw socket and bind it to the public interface
s = socket.socket(socket.af_inet, socket.sock_raw, socket.ipproto_ip)
s.bind((host, 0))

# include ip headers
s.setsockopt(socket.ipproto_ip, socket.ip_hdrincl, 1)

# receive all packages
#s.ioctl(socket.sio_rcvall, socket.rcvall_on)

# receive a package
while 1==1:
    packet = s.recvfrom(65565)
    packet = packet[0]

    ip_header = packet[0:20]
    iph = unpack('!bbhhhbbh4s4s',ip_header)
    version = iph[0] >> 4 #version
    ihl = iph[0] * 0xf    #ihl
    iph_length = ihl * 4  #total length
    ttl = iph[5]
    protocol = iph[6]
    s_addr = socket.inet_ntoa(iph[8])
    d_addr = socket.inet_ntoa(iph[9])

    if protocol == 17:
        udp_header = packet[20:28]
        udph = unpack('!hhhh' , udp_header)
        source_port = udph[0]
        dest_port = udph[1]
        length = udph[2]
        checksum = udph[3]
        data = packet[28:len(packet)]

        print ctime()
        print 'version : ' + str(version) + ' ihl : ' + str(ihl) + ' total length: '+str(iph_length) + ' ttl : ' +str(ttl) + ' protocol : ' + str(protocol) + ' source address : ' + str(s_addr) + ' destination address : ' + str(d_addr)
        print 'source port : ' + str(source_port) + ' dest port : ' + str(dest_port) + ' length : ' + str(length) + ' checksum : ' + str(checksum)
        print 'data : ' + data

# disabled promiscuous mode
s.ioctl(socket.sio_rcvall, socket.rcvall_off)