使用 Winpcap 重建 Tcp 会话
我正在尝试从我的 pcap 文件重建 tcp 会话，这些文件具有使用 winpcap 捕获的网络数据包。我有一个将数据包拆分为会话的项目。到目前为止，我可以根据会话读取 pcap 文件并分组数据包。
我想了解的是这次手术之后我应该做什么。我认为为了从这些会话中获取数据，我必须根据它们的序列号对这些数据包进行排序。我说得对吗？我是否需要额外的操作来构造 tcp 会话数据。我如何知道哪些数据是图像、html 或 javascript？任何有关良好资源的建议将不胜感激。
顺便说一句，我使用 SharpPcap 和 Pcap.Net 将数据包分割到 TCP 会话。这些库足以用于 tcp 会话重建吗？
I'm trying to reconstruct tcp sessions from my pcap files which have network packets captured using winpcap. I have a project which splits the packets to sessions. So far I can read from pcap files and group packets according to their sessions.
What I want to learn is what should I do after this operations. I think in order to get data from these sessions I have to order these packets according to their sequence numbers. Am I right? Do I need extra operations to construct tcp session data. How can I know which data is image, html or javascript? Any suggestion for a good resource will be much appreciated.
By the way, I'm using SharpPcap and Pcap.Net for splitting packets to tcp sessions. Is these libraries enough for tcp session reconstruction?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Pcap.Net 已经有一个 HTTP 解析器，如果人们需要的话，它可能会通过更多功能得到增强。
关于 TCP 重建，欢迎您为这个请求的功能投票，我希望在下一个版本中做到这一点。
TCP 重建并不是那么简单，但是一旦您将数据包分组到 TCP 会话、对它们进行排序并删除重复项，它就会大部分工作。仍然有一些极端情况需要处理，这也取决于您接收数据包的线路的质量。
一旦你有了重建的流，你就可以使用 Pcap.Net 的 HttpDatagram 来解析它。
Pcap.Net already has an HTTP parser, which would probably be enhanced with more features if people would request them.
Regarding TCP reconstruction, you're welcome to vote for this requested feature, I hope to do it in one of the next versions.
TCP reconstruction isn't that trivial, but it would mostly work once you group packet to TCP sessions, order them and remove duplicates. There are still corner cases that need to be handled, which also depend on the quality of the line you receive the packets from.
Once you have a reconstructed stream, you can use the Pcap.Net's
HttpDatagramto parse it.您基本上需要重新实现 tcp/ip 堆栈和 http 会话解析器。
TCP 数据包需要重新排序并删除重复/无效数据包。
需要处理这些数据包以识别 http 会话。数据解压缩和标头处理将让您识别 MIME 类型。
Sharppcap 或 pcapdotnet 单独应该可以为您想要做的事情奠定基础。我确信 Sharppcap 可以，因为我是作者。
我有一个商业产品，可以与 Sharppcap 一起进行 tcp 跟踪和 http 解析，[email] protected] 如果您对某事感兴趣它已经过单元测试并用于其他商业产品。
You basically need to reimplement a tcp/ip stack and a http session parser.
Tcp packets need to be reordered and duplicates/invalids removed.
Those packets need to be processed to identify http sessions. Decompression of data and header processing will let you identIfy the mime type.
Sharppcap or pcapdotnet alone should work for a foundation of what you want to do. I'm positive sharppcap can since I'm the author.
I have a commercial product that works with sharppcap to do both tcp following and http parsing, [email protected] if you are interested in something that has been unit tested and used in other commercial products.