capturing.pas

一个SNOOP控件,各位看看可以对网络包进行分析.

unit Capturing;

interface

uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls, ExtCtrls, Snoop, Global, SnoopMemory;

type
  TCapturingForm = class(TForm)
    Label1: TLabel;
    Label2: TLabel;
    Label3: TLabel;
    Label4: TLabel;
	Label5: TLabel;
	Label6: TLabel;
	Label7: TLabel;
	Label8: TLabel;
    lblEthernet: TLabel;
	lblIP: TLabel;
	lblARP: TLabel;
	lblICMP: TLabel;
	lblTCP: TLabel;
	lblUDP: TLabel;
	lblTCPData: TLabel;
	lblUDPData: TLabel;
	Bevel1: TBevel;
	btnClose: TButton;
    tmrView: TTimer;
	procedure FormCreate(Sender: TObject);
	procedure FormShow(Sender: TObject);
	procedure FormClose(Sender: TObject; var Action: TCloseAction);
    procedure btnCloseClick(Sender: TObject);
    procedure tmrViewTimer(Sender: TObject);
  private
	{ Private declarations }
	EthernetCount: Integer;
	IPCount: Integer;
	ARPCount: Integer;
	ICMPCount: Integer;
	TCPCount: Integer;
	UDPCount: Integer;
	TCPDataCount: Integer;
	UDPDataCount: Integer;
  public
	{ Public declarations }
	procedure Initialize;
	procedure View;
	procedure Process(PacketHeader: PPCAP_PKTHDR; EthernetHeader: PETHERNET_HDR);
  end;

var
  CapturingForm: TCapturingForm;

implementation

uses Main;

{$R *.DFM}

procedure TCapturingForm.Initialize;
begin
	EthernetCount := 0;
	IPCount := 0;
	ARPCount := 0;
	ICMPCount := 0;
	TCPCount := 0;
	UDPCount := 0;
	TCPDataCount := 0;
	UDPDataCount := 0;
end;

procedure TCapturingForm.View;
begin
	lblEthernet.Caption := IntToStr(EthernetCount);
	lblIP.Caption := IntToStr(IPCount);
	lblARP.Caption := IntToStr(ARPCount);
	lblICMP.Caption := IntToStr(ICMPCount);
	lblTCP.Caption := IntToStr(TCPCount);
	lblUDP.Caption := IntToStr(UDPCount);
	lblTCPData.Caption := IntToStr(TCPDataCount);
	lblUDPData.Caption := IntToStr(UDPDataCount);
end;

procedure TCapturingForm.Process(PacketHeader: PPCAP_PKTHDR; EthernetHeader: PETHERNET_HDR);
var
	IPHeader: PIP_HDR;
	TCPHeader: PTCP_HDR;
	UDPHeader: PUDP_HDR;
begin
	inc(EthernetCount);
	if snoopIsIP(EthernetHeader, @IPHeader) then
	begin
		inc(IPCount);
		if snoopIsTCP(IPHeader, @TCPHeader) then
		begin
			inc(TCPCount);
			if snoopIsTCPData(IPHeader, TCPHeader) then
				inc(TCPDataCount);
		end else if snoopIsUDP(IPHeader, @UDPHeader) then
		begin
			inc(UDPCount);
			if snoopIsUDPData(IPHeader, UDPHeader) then
				inc(UDPDataCount);
		end else if snoopIsICMP(IPHeader) then
			inc(ICMPCount);
	end else if snoopIsARP(EthernetHeader) then
	begin
		inc(ARPCount);
	end;
end;

procedure TCapturingForm.FormCreate(Sender: TObject);
begin
//
end;

procedure TCapturingForm.FormShow(Sender: TObject);
begin
	View;
	tmrView.Enabled := true;
end;

procedure TCapturingForm.FormClose(Sender: TObject;
  var Action: TCloseAction);
begin
	tmrView.Enabled := false;
end;

procedure TCapturingForm.btnCloseClick(Sender: TObject);
begin
	MainForm.ActionClose.Execute;
end;

procedure TCapturingForm.tmrViewTimer(Sender: TObject);
begin
	View;
end;

end.