//c代碼

#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
#include <string.h>
#include <netinet/in.h>
#include <time.h>
#include <syslog.h>

/* *.pcap file format  =  file header(24B) + pkt header(16B) + Frame 
 * Frame  =  Ethernet header(14B) + IP header(20B) + UDP header(8B) + appdata 
 
*/


//enhernet header (14B)
typedef struct _eth_hdr  
{  
    unsigned char dstmac[6]; //目標mac地址   
    unsigned char srcmac[6]; //源mac地址   
     unsigned short eth_type; //以太網類型   
}eth_hdr; 


//IP header 20B
typedef struct _ip_hdr  
{  
    unsigned char ver_hlen; //版本    
    unsigned char tos;       //服務類型   
 

    unsigned short tot_len;  //總長度   
    unsigned short id;       //標誌   
    unsigned short frag_off; //分片偏移   
    unsigned char ttl;       //生存時間   
    unsigned char protocol;  //協議   
    unsigned short chk_sum;  //檢驗和   
    struct in_addr srcaddr;  //源IP地址   
    struct in_addr dstaddr;  //目的IP地址   
}ip_hdr;
  

 
//udp header  8B
typedef struct _udp_hdr  
{  
    unsigned short src_port; //遠端口號   
    unsigned short dst_port; //目的端口號   
    unsigned short uhl;      //udp頭部長度   
    unsigned short chk_sum;  //16位udp檢驗和   
}udp_hdr;

#define FILE_HEADER          24
#define FRAME_HEADER_LEN     (sizeof(eth_hdr) + sizeof(ip_hdr) + sizeof(udp_hdr))
#define LOGLEN               2048
#define NEED_HEADER_INFO     1 

int main(int argc, char **argv)
{
    FILE *fp;
    int fileOffset;
    int pktHeaderLen;
    char data[LOGLEN] = {0};
//    struct pcap_file_header *fHeader; 
    struct pcap_pkthdr *pktHeader;

    if (argc < 2) {
        printf("usage: ./exe *.pcap\n");
        exit(1);
    }
#ifdef NEED_HEADER_INFO
    printf("nead header info\n");
    eth_hdr *EthHeader;
    ip_hdr *IPHeader;
    udp_hdr *UDPHeader;

    EthHeader  = (eth_hdr*)malloc(sizeof(*EthHeader));
    IPHeader  = (ip_hdr*)malloc(sizeof(*IPHeader));
    UDPHeader  = (udp_hdr*)malloc(sizeof(*UDPHeader));

    memset(EthHeader, 0, sizeof(*EthHeader));
    memset(IPHeader, 0, sizeof(*IPHeader));
    memset(UDPHeader, 0, sizeof(*UDPHeader));
#endif
    pktHeader = (struct pcap_pkthdr*)malloc(sizeof(*pktHeader));
    memset(pktHeader, 0, sizeof(*pktHeader));

    fp = fopen(argv[1], "r");
    if (fp == NULL) {
        perror("open file error");
        exit(-1);
    }

    openlog("test", LOG_PID, 0);
    fileOffset = FILE_HEADER;    //ingore file header
    while (fseek(fp, fileOffset, SEEK_SET) == 0) {
        // can get time from pktheader
        if (fread(pktHeader, 1, sizeof(*pktHeader), fp) == 0) {
            printf("file end\n");
            return 0;
        }   
        fileOffset += 16 + pktHeader->len;
        pktHeaderLen = pktHeader->len - FRAME_HEADER_LEN;

        printf("%d\n", pktHeaderLen);

#ifdef NEED_HEADER_INFO
        //get eth header...
        if (fread(EthHeader, 1, sizeof(*EthHeader), fp) == 0) {
            printf("file end\n");
            return 0;
        }   

        //get ip header...
        if (fread(IPHeader, 1, sizeof(*IPHeader), fp) == 0) {
            printf("file end\n");
            return 0;
        }   
               
        //get udp herader 
        if (fread(UDPHeader, 1, sizeof(*UDPHeader), fp) == 0) {
            printf("file end\n");
            return 0;
        }   
#else
        fseek(fp,  FRAME_HEADER_LEN, SEEK_CUR); //ingore ether header
#endif
        if (fread(data, 1, pktHeaderLen, fp) == 0) {
            printf("file end\n");
            return 0;
        }   
        data[pktHeaderLen] = ‘\0‘;
        
        printf("%s\n", data);
        sleep(1);
        syslog(LOG_SYSLOG | LOG_INFO, "%s", data);
        memset(data, 0, LOGLEN);
    }

    free(pktHeader);
#ifdef NEED_HEADER_INFO
    free(EthHeader);
    free(IPHeader);
    free(UDPHeader);
#endif
    closelog();
    fclose(fp);
    return 0;
}

測試已通過

分析pcap包（基於UDP）