确定 HTTP 数据包
您好，
如何从使用 Sharppcap 捕获的数据包中确定数据包是否是 http 数据包？
我们能否确定 frpm TCP 数据包是否是 HTTP？
Greeting,
how is possible to determine from captured packets using sharppcap if the packet is http packet or not?
and can we determine frpm TCP packets if the packet is HTTP or not?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
根据 rfc2616 - 超文本传输协议 - HTTP/1.1：
因此，您可以检查数据包并扫描消息标头中的 HTTP 版本文本和/或 HTTP 协议的其他已知字段。虽然如果一条消息被分成多个数据包，此方法可能不是 100% 准确，但它可能足够好，至少作为第一次切割。
According to rfc2616 - Hypertext Transfer Protocol -- HTTP/1.1:
So, you could inspect packets and scan for the HTTP version text in message headers, and/or other known fields of the HTTP protocol. Although this method may not be 100% accurate if a message is broken up into multiple packets, it would probably be good enough, at least as a first cut.
我是
sharppcap/packet.net的作者/维护者。我有一些执行
tcp重组和http解析的类，这些类在复杂的网络监控应用程序中用于识别和跟踪http 会话。这些都经过了充分的单元测试并得到了很好的评论。它们可用于二进制或源代码级别的许可。
编辑：为什么投票否决？开发代码和测试花费了数百个小时，这是一个已被重用的解决方案。在重新实现相同的功能之前，这当然值得考虑。
I am the author/maintainer of
sharppcap/packet.net.I have a few classes that perform
tcpreassembly andhttpparsing that are in use in a complex network monitoring app to identify and followhttp sessions. These are fully unit tested and well commented.They are available for licensing either at the binary or source level.
Edit: Why vote this down? It took hundreds of hours to develop the code and tests and it's a drop in solution that has been reused. It's certainly worth considering before re-implementing the same functionality.
听起来您正在查看单个 TCP 片段。如果它来自消息的开头，那么它的第一行将有一个 HTTP 版本，但如果您只是从网络上随机提取数据包并希望能够知道它们是 HTTP，那么您就不走运了- TCP 片段中没有任何内容表明其中的内容。唯一了解的方法就是查看整个对话。
It sounds like you're looking at a single TCP fragment. If that came from the beginning of a message, it will have an HTTP version in the first line, but if you're just pulling random packets off the network and hoping to be able to tell they're HTTP you're out of luck - there is nothing in the TCP fragments which indicates what is in them. The only way to know would be to look at the whole conversation.