preface
pcap/.cap file is a commonly used datagram storage format file. The data is stored in a specific format. The ordinary editor cannot normally open this type of file. The Ultra Edit editor can view the data in hexadecimal format, and cannot visually view the important information of the data. Specific parsing tool software is required to read and view, such as WiresharkPortable or Microsoft Network Monitor.
problem
However, some development tasks need some information in the data file (. pcap/.cap) for subsequent processing, and the software can not be used to obtain the information and input it into the program, which brings some difficulties to the development tasks.
solve
The pcap4j library is introduced, which captures data packets through the network interface and converts them into Java objects. Each field of the packet header can be obtained / set through a Java object converted from the packet. You can also make packet objects from scratch. Pcap4j also has more powerful functions, and is interested in WeChat official account: Java bad pen, reply: pcap4j-1, check the complete source code and explanation.
Sample code
maven dependency
<dependencies> <dependency> <groupId>org.pcap4j</groupId> <artifactId>pcap4j-core</artifactId> <version>1.8.2</version> </dependency> <dependency> <groupId>org.pcap4j</groupId> <artifactId>pcap4j-packetfactory-static</artifactId> <version>1.8.2</version> </dependency> </dependencies>
package org.pcap4j.sample; import java.io.EOFException; import java.util.concurrent.TimeoutException; import org.pcap4j.core.NotOpenException; import org.pcap4j.core.PcapHandle; import org.pcap4j.core.PcapHandle.TimestampPrecision; import org.pcap4j.core.PcapNativeException; import org.pcap4j.core.Pcaps; import org.pcap4j.packet.Packet; @SuppressWarnings("javadoc") public class ReadPacketFile { private static final int COUNT = 5; private static final String PCAP_FILE_KEY = ReadPacketFile.class.getName() + ".pcapFile"; private static final String PCAP_FILE = System.getProperty(PCAP_FILE_KEY, "src/main/resources/echoAndEchoReply.pcap"); private ReadPacketFile() {} public static void main(String[] args) throws PcapNativeException, NotOpenException { PcapHandle handle; try { handle = Pcaps.openOffline(PCAP_FILE, TimestampPrecision.NANO); } catch (PcapNativeException e) { handle = Pcaps.openOffline(PCAP_FILE); } for (int i = 0; i < COUNT; i++) { try { Packet packet = handle.getNextPacketEx(); System.out.println(handle.getTimestamp()); System.out.println(packet); } catch (TimeoutException e) { } catch (EOFException e) { System.out.println("EOF"); break; } } handle.close(); } }
2012-09-12 13:27:27.609228 [Ethernet Header (14 bytes)] Destination address: 00:01:8e:f9:a7:60 Source address: 04:7d:7b:4c:2f:0a Type: 0x0800 (IPv4) [IPv4 Header (20 bytes)] Version: 4 (IPv4) IHL: 5 (20 [bytes]) TOS: [precedence: 0 (Routine)] [tos: 0 (Default)] [mbz: 0] Total length: 60 [bytes] Identification: 18814 Flags: (Reserved, Don't Fragment, More Fragment) = (false, false, false) Fragment offset: 0 (0 [bytes]) TTL: 128 Protocol: 1 (ICMPv4) Header checksum: 0x0000 Source address: /192.168.2.101 Destination address: /192.168.2.1 [ICMPv4 Common Header (4 bytes)] Type: 8 (Echo) Code: 0 (No Code) Checksum: 0x4c5b [ICMPv4 Echo Header (4 bytes)] Identifier: 256 SequenceNumber: 1 [data (32 bytes)] Hex stream: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69 2012-09-12 13:27:27.609965 [Ethernet Header (14 bytes)] Destination address: 04:7d:7b:4c:2f:0a Source address: 00:01:8e:f9:a7:60 Type: 0x0800 (IPv4) [IPv4 Header (20 bytes)] Version: 4 (IPv4) IHL: 5 (20 [bytes]) TOS: [precedence: 0 (Routine)] [tos: 0 (Default)] [mbz: 0] Total length: 60 [bytes] Identification: 30935 Flags: (Reserved, Don't Fragment, More Fragment) = (false, false, false) Fragment offset: 0 (0 [bytes]) TTL: 64 Protocol: 1 (ICMPv4) Header checksum: 0x7c33 Source address: /192.168.2.1 Destination address: /192.168.2.101 [ICMPv4 Common Header (4 bytes)] Type: 0 (Echo Reply) Code: 0 (No Code) Checksum: 0x545b [ICMPv4 Echo Reply Header (4 bytes)] Identifier: 256 SequenceNumber: 1 [data (32 bytes)] Hex stream: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69 2012-09-12 13:27:28.611932 [Ethernet Header (14 bytes)] Destination address: 00:01:8e:f9:a7:60 Source address: 04:7d:7b:4c:2f:0a Type: 0x0800 (IPv4) [IPv4 Header (20 bytes)] Version: 4 (IPv4) IHL: 5 (20 [bytes]) TOS: [precedence: 0 (Routine)] [tos: 0 (Default)] [mbz: 0] Total length: 60 [bytes] Identification: 18815 Flags: (Reserved, Don't Fragment, More Fragment) = (false, false, false) Fragment offset: 0 (0 [bytes]) TTL: 128 Protocol: 1 (ICMPv4) Header checksum: 0x0000 Source address: /192.168.2.101 Destination address: /192.168.2.1 [ICMPv4 Common Header (4 bytes)] Type: 8 (Echo) Code: 0 (No Code) Checksum: 0x4c5a [ICMPv4 Echo Header (4 bytes)] Identifier: 256 SequenceNumber: 2 [data (32 bytes)] Hex stream: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69 2012-09-12 13:27:28.61251 [Ethernet Header (14 bytes)] Destination address: 04:7d:7b:4c:2f:0a Source address: 00:01:8e:f9:a7:60 Type: 0x0800 (IPv4) [IPv4 Header (20 bytes)] Version: 4 (IPv4) IHL: 5 (20 [bytes]) TOS: [precedence: 0 (Routine)] [tos: 0 (Default)] [mbz: 0] Total length: 60 [bytes] Identification: 30936 Flags: (Reserved, Don't Fragment, More Fragment) = (false, false, false) Fragment offset: 0 (0 [bytes]) TTL: 64 Protocol: 1 (ICMPv4) Header checksum: 0x7c32 Source address: /192.168.2.1 Destination address: /192.168.2.101 [ICMPv4 Common Header (4 bytes)] Type: 0 (Echo Reply) Code: 0 (No Code) Checksum: 0x545a [ICMPv4 Echo Reply Header (4 bytes)] Identifier: 256 SequenceNumber: 2 [data (32 bytes)] Hex stream: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69 2012-09-12 13:27:29.611909 [Ethernet Header (14 bytes)] Destination address: 00:01:8e:f9:a7:60 Source address: 04:7d:7b:4c:2f:0a Type: 0x0800 (IPv4) [IPv4 Header (20 bytes)] Version: 4 (IPv4) IHL: 5 (20 [bytes]) TOS: [precedence: 0 (Routine)] [tos: 0 (Default)] [mbz: 0] Total length: 60 [bytes] Identification: 18816 Flags: (Reserved, Don't Fragment, More Fragment) = (false, false, false) Fragment offset: 0 (0 [bytes]) TTL: 128 Protocol: 1 (ICMPv4) Header checksum: 0x0000 Source address: /192.168.2.101 Destination address: /192.168.2.1 [ICMPv4 Common Header (4 bytes)] Type: 8 (Echo) Code: 0 (No Code) Checksum: 0x4c59 [ICMPv4 Echo Header (4 bytes)] Identifier: 256 SequenceNumber: 3 [data (32 bytes)] Hex stream: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69
Complete source code
Example source code concerns WeChat official account: Java bad pen, reply: pcap4j
Application scenario
Requirements: when the data block is relatively large, the data block will be compressed. When it is necessary to view the content of the data package by grasping the package, it cannot be viewed directly through the software. It brings inconvenience to the troubleshooting of practical engineering problems. It is necessary to develop a tool to judge whether the data is compressed. If compressed, decompress it.
Function: analyze the message. The message protocol is as follows: extract the compressed message, decompress the data, and output the decompressed binary data.
Input: the message file of the captured device.
Output: output the decompressed binary data.
Format:
Time:
Source ip:
Host ip:
Data:
Idea: the time, source address, destination address and hexadecimal data of each data can be directly read through pcap4j parsing library. Secondly, check the message data through Microsoft Network Monitor software to find out the hexadecimal data bit indicating whether it is compressed, find out the position law of the compressed bit of each data, and turn this bit into the last bit of binary to indicate whether it is compressed, 1 means compressed and 0 means uncompressed. Then convert the compressed data into binary output.
The source code is not easy to display here. If you need to pay attention to and privately believe in WeChat official account, Java is bad.
