如何使用 SharpPcap 从 TCPPacket 获取数据？
我的报告需要小型嗅探器，所以我选择了 C# 和 SharpPcap。
packet = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
tcpPacket = TcpPacket.GetEncapsulated(packet);
我有包含所有数据包数据的原始数据包。然后我从其中获取数据包，其中包含一些信息，例如源/目的地/协议/等。之后我从中获取 TCP 数据包。
现在我如何仅获取软件发送/接收的实际数据包数据？
I need small sniffer for my report so I went with C# and SharpPcap.
packet = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
tcpPacket = TcpPacket.GetEncapsulated(packet);
I have raw packet with all packet data. Then I get Packet out of it with some info such as source/destination/protocol/etc. After that I get tcp packet out of that.
Now how do I get only actual packet data that software sent/received?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
很简单。
Was simple enough.
tcpPacket.PayloadData 或 PayloadPacket 应该是你想要的。如果 Packet.Net 不知道如何将数据解析为子数据包，则 PayloadData 有效；如果知道，则 PayloadPacket 有效。我不确定今天是否发生任何 tcp 数据包解析，因此您应该放心地说 tcpPacket.PayloadData。
也许应该更改 api，以便 PayloadData 始终是 tcp 数据包中的原始数据，并且 PayloadPacket 为 null 或非 null，具体取决于数据包的内容是否被解析。然后您可以使用 PayloadData 获取任何数据包、以太网、IP 等的内容。想法？
您可以引用“数据包”的某些嵌套PayloadPacket，但很难知道数据包是如何构造的。是以太网->IP->Tcp 还是以太网数据包周围有包装器？使用 TcpPacket.GetEncapsulated() 可以为您处理这些情况。
Chris
SharpPcap/Packet.Net 的作者
tcpPacket.PayloadData or PayloadPacket should be what you want. PayloadData is valid if Packet.Net isn't aware of how to parse the data into a sub-packet, and PayloadPacket is valid if it does. I'm not sure any tcp packet parsing occurs today so you should be safe saying tcpPacket.PayloadData.
Maybe the api should be changed such that PayloadData is always the raw data in the tcp packet and PayloadPacket is null or non-null depending on whether the contents of the packet were parsed. Then you could get the contents of any packet, Ethernet, IP etc by using PayloadData. Thoughts?
You could refer to some nested PayloadPacket of 'packet' but it is difficult to know how the packet is constructed. Is it Ethernet->IP->Tcp or are there wrappers around the Ethernet packet? With TcpPacket.GetEncapsulated() these situations are handled for you.
Chris
Author of SharpPcap/Packet.Net