console.dpr

一个SNOOP控件,各位看看可以对网络包进行分析.

program Console;
{$APPTYPE CONSOLE}
uses
  Windows,
  SysUtils,
  Snoop in '..\..\Source\Snoop.pas';

type
  TConsole = class
  public
	Count: Integer;
	SnoopTCPData: TSnoopTCPData;
	constructor Create;
	destructor Destroy; override;
	procedure OnCaptureTCPData(
	  Sender: TObject;
	  PacketHeader: PPCAP_PKTHDR;
	  EthernetHeader: PETHERNET_HDR;
	  IPHeader: PIP_HDR;
	  TCPHeader: PTCP_HDR;
	  TCPData: PChar;
	  TCPDataLength: Integer);
  end;

function IsNormalChar(ch: Char): Boolean;
begin
	Result := false;
	if (Ord(ch) >= 32) and (Ord(ch) <= 192) then
		Result := true;
end;

constructor TConsole.Create;
begin
	inherited;
	Count := 0;
	SnoopTCPData := TSnoopTCPData.Create(nil);
	SnoopTCPData.OnCaptureTCPData := OnCaptureTCPData;
end;

destructor TConsole.Destroy;
begin
	SnoopTCPData.Free;
	inherited;
end;

procedure TConsole.OnCaptureTCPData(
	Sender: TObject;
	PacketHeader: PPCAP_PKTHDR;
	EthernetHeader: PETHERNET_HDR;
	IPHeader: PIP_HDR;
	TCPHeader: PTCP_HDR;
	TCPData: PChar;
	TCPDataLength: Integer);
var
	i: Integer;
	Data: String;
begin
	Data := '';
	for i := 1 to TCPDataLength do
	begin
		if IsNormalChar(TCPData^) then
			Data := Data + TCPData^;
		inc(TCPData);
	end;
	WriteLn(Data);
	inc(Count);
end;

const
	DETECT_TIME = 10000;
begin
	with TConsole.Create do
	begin
		SnoopTCPData.AdapterIndex := 0;
		SnoopTCPData.ThreadSafe := false;
		SnoopTCPData.Open;
		if not SnoopTCPData.Active then
		begin
			WriteLn(SnoopTCPData.Error);
			exit;
		end;
		Sleep(DETECT_TIME);
		SnoopTCPData.Close;
		Free;
		WriteLn(#13#10, Count, ' packet(s) captured during ', DETECT_TIME, ' millisecond.');
	end;
end.