tcpgram.cpp

这是一个嗅探器

// TCPGram.cpp: implementation of the TCPGram class.
//
//////////////////////////////////////////////////////////////////////

#include "stdafx.h"
#include "snifferpro.h"
#include "TCPGram.h"

#ifdef _DEBUG
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#define new DEBUG_NEW
#endif

//////////////////////////////////////////////////////////////////////
// Construction/Destruction
//////////////////////////////////////////////////////////////////////

TCPGram::TCPGram()
{

}

TCPGram::TCPGram(const unsigned char *buf,int buflen)
{
	//unsigned char *buf;
	unsigned char *pos;
	//int buflen;

	//buflen=bufferlen;
	//buf=new unsigned char[buflen];
	//memcpy(buf,buffer,buflen);

	pos=(unsigned char *)buf;
	srcport=(*pos)*0x100+(*(pos+1));

	pos+=2;
	destport=(*pos)*0x100+(*(pos+1));

	pos+=2;
	seqnum=(*pos)*0x1000000+(*(pos+1))*0x10000+(*(pos+2))*0x100+(*(pos+3));

	pos+=4;
	acknum=(*pos)*0x1000000+(*(pos+1))*0x10000+(*(pos+2))*0x100+(*(pos+3));

	pos+=4;
	headlen=(*pos)/16;

	pos++;
	if(*pos & 0x20)
		URG=true;
	else 
		URG=false;
	if(*pos & 0x10)
		ACK=true;
	else
		ACK=false;
	if(*pos & 0x08)
		PSH=true;
	else
		PSH=false;
	if(*pos & 0x04)
		RST=true;
	else
		RST=false;
	if(*pos & 0x02)
		SYN=true;
	else
		SYN=false;
	if(*pos & 0x01)
		FIN=true;
	else
		FIN=false;

	pos++;
	windowsize=(*pos)*0x100+(*(pos+1));

	pos+=2;
	checksum=(*pos)*0x100+(*(pos+1));

	pos+=2;
	urgpos=(*pos)*0x100+(*(pos+1));

	if(headlen>5){
		pos+=2;
		optlen=headlen*4-20;
		options=new unsigned char[optlen];
		memcpy(options,buf+20,optlen);
	}
	else{
		optlen=0;
		options=NULL;
	}

	pos=(unsigned char *)(buf+headlen*4);
	datalen=buflen-headlen*4;
	if(datalen>0){
		data=new unsigned char[datalen];
		memcpy(data,buf+headlen*4,datalen);
	}
	else{
		data=NULL;
		data=0;
	}

	//delete[] buf;
}
TCPGram::~TCPGram()
{
	if(options!=NULL)
		delete[] options;	
	if(data!=NULL)
		delete[] data;
}