用 C 连接到 TCP 堆栈
我想要在这里做的不仅仅是一次捕捉。 我想首先捕获数据包，然后实时检查有效负载中的特定数据，将其删除，注入签名并将数据包重新注入到要像以前一样发送的堆栈中。
我读过使用 IPFW 的 ipfw 转移套接字，它看起来非常有前途。 修改数据包并使用转移套接字将它们重新注入堆栈的示例怎么样？ 另外，出于好奇，是否可以使用 Java 从套接字读取数据，或者这是否会限制我打包和重新注入等？
It's not just a capture I'm looking to do here. I want to first capture the packet, then in real time, check the payload for specific data, remove it, inject a signature and reinject the packet into the stack to be sent on as before.
I had a read of the ipfw divert sockets using IPFW and it looks very promising. What about examples in modifying packets and reinjecting them back into the stack using divert sockets? Also, as a matter of curiosity, would it be possible to read the data from the socket using Java or would this restrict me with packing mangling and reinjecting etc?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我本来打算回应推荐 iptables 的其他回复（取决于您尝试匹配的模式和您想要进行的数据包修改的复杂性），直到我注意到该问题上的 BSD 标签。
正如 Stephen Pellicer 已经提到的，libpcap 是捕获数据包的一个不错的选择。 不过，我相信 libpcap 也可以用于发送数据包。 作为参考，我很确定 tcpreplay 使用它来重播 pcap 格式的文件。
I was going to echo other responses that have recommended iptables (depending on the complexity of both the patterns that you're trying to match and the packet modifications that you want to make) - until I took notice of the BSD tag on the question.
As Stephen Pellicer has already mentioned, libpcap is a good option for capturing the packets. I believe, though, that libpcap can also be used to send packets. For reference I'm pretty sure that tcpreplay uses it to replay pcap formatted files.
我认为可以使用 QUEUE 或 NFQUEUE iptables 目标在用户空间中执行此操作。 客户端应用程序附加到队列并接收所有匹配的数据包，它可以在重新注入之前对其进行修改（如果需要，也可以删除它们）。
有一个客户端库 libnetfilter_queue 需要链接到它。 遗憾的是，文档很少，但有一些邮件列表帖子和示例。
出于性能原因，您不想对每个数据包执行此操作，而只想对特定的匹配数据包执行此操作，您必须使用标准 iptables 规则来匹配这些数据包。 如果这还不够，您需要编写自己的 netfilter 内核模块。
It's possible to do this in userspace with the QUEUE or NFQUEUE iptables target I think. The client application attaches to a queue and receives all matching packets, which it can modify before they're re-injected (it can also drop them if it wants).
There is a client library libnetfilter_queue which it needs to link against. Sadly documentation is minimal, but there are some mailing list posts and examples knocking around.
For performance reasons, you won't want to do this to every packet, but only specific matching ones, which you'll have to match using standard iptables rules. If that doesn't do enough, you'll need to write your own netfilter kernel module.
如果您只是寻找数据包捕获，libpcap 非常受欢迎。 它用于 tcpdump 和 ethereal 等基本工具中。 至于“挂钩到堆栈”，除非您计划从根本上改变网络的实现方式（即添加您自己的层或改变 TCP 的行为），否则您使用 IPF 进行数据包修改或干预的想法似乎是这样的最好的选择。 在 Linux 中，它们对用户空间模块有一个特定的重定向目标，IPF 可能有类似的东西，或者您可以修改 IPF 来执行类似的操作。
如果您只是想查看数据包，那么 libpcap 就是您的最佳选择。 您可以在以下位置找到它：http://www.tcpdump.org/
If you're just looking for packet capture, libpcap is very popular. It's used in basic tools such as tcpdump and ethereal. As far as "hooking into the stack", unless you plan on fundamentally changing the way the way the networking is implemented (i.e. add your own layer or alter the behavior of TCP), your idea of using IPF for packet modification or intervention seems like the best bet. In Linux they have a specific redirection target for userspace modules, IPF probably has something similar or you could modify IPF to do something similar.
If you are just interested in seeing the packets, then libpcap is the way to go. You can find it at: http://www.tcpdump.org/
请参阅转移套接字：转移套接字迷你 HOWTO 。
它们的工作原理是将与特定 ipfw 规则匹配的流量传递到特殊的原始套接字，然后该套接字可以将更改后的流量重新注入网络层。
See divert sockets: Divert Sockets mini HOWTO.
They work by passing traffic matching a certain ipfw rule to a special raw socket that can then reinject altered traffic into the network layers.