嗅探并阻止服务器中的数据包
我对西北嗅探的概念很陌生。 <所以，我将尝试用我所知道的最好的术语来描述问题>
在一个组织中，有 30 台计算机连接到服务器。当这些系统的用户浏览互联网时，数据包通过该服务器发送到外部网络。我想编写一个在此服务器中运行的应用程序，它嗅探这些数据包，读取 Http 请求，IP 地址来分析这些数据包。数据包并阻止那些令人反感的内容。
从哪里开始？请帮忙。提前致谢。
I'm new to the concept of nw-sniffing. < so , i'll try to describe the problem with the best terms i know >
In an organisation , there are 30 computers connected to a server. And as users of these systems browse the Internet , packets are sent to the outside nw via this server.. i want to write an application that runs in this server , that sniffs these packets , reads the Http requests , the IP addresses to analyse these packets and block those found objectionable.
Where to begin ? pl help. Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
最好的起点肯定是理论。了解 IP 数据包是如何构建的、HTTP 数据包是什么样子以及网络在低级别上是如何构建的。有很多值得学习的地方。
就学习工具而言，我强烈推荐 Wireshark。允许您执行 DPI（深度数据包检查）并习惯您所追求的。
DPI 的常见方法是使用 SOCKS 服务器或类似代理来过滤所有流量。
DPI 也有缺点。它将影响您的网络，如果实施不当，很容易增加单点故障。
The best place to begin would definately be theory. Look up how IP packets are built-up, what a HTTP packet looks like and how networks are structured at a low level. There's alot worth learning.
As far as tools for learning go, I'd highly recommend Wireshark. Allow you to perform DPI (Deep Packet Inspection) and get used to what you're after.
A common method of DPI is to use a SOCKS server or similar proxy through which all traffic is filtered.
DPI has downsides. It will affect your network and, if naively implemented, can easily add a single point of failure.