识别数据包来自 pcap.net 中的接口？

Question

我正在使用带有两个网络接口控制器的计算机构建一座桥。我正在使用多线程安排从使用 pcap.net 的两个接口接收数据包。问题是我不知道如何识别数据包是从哪个接口接收的。数据包是否携带任何可以判断它们从哪个接口被嗅探的信息？

如果没有，可能的解决方法是将参数传递给回调函数。这可能吗？

Answer 1

ReceivePackets 的默认事件处理程序不提供接口信息。真的！另一方面，它所期望的只是一个 delegate void 采用单个 Packet 参数。

让我们提供一个：

communicator.ReceivePackets(0, packet => PacketHandler(selectedDevice, packet));

我们会将捕获的数据包传递给我们的委托，然后调用传入我们设备的数据包处理程序。

我改编了 Pcap.Net site 上的一个示例。

namespace ConsoleApplication7
{
    using System;
    using System.Collections.Generic;

    using PcapDotNet.Core;
    using PcapDotNet.Packets;

    internal class Program
    {
        private static void Main(string[] args)
        {
            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

            if (allDevices.Count == 0)
            {
                Console.WriteLine("No interfaces found! Make sure WinPcap is installed.");
                return;
            }

            for (int i = 0; i != allDevices.Count; ++i)
            {
                var device = allDevices[i];

                Console.Write((i + 1) + ". " + device.Name);

                if (device.Description != null)
                {
                    Console.WriteLine(" (" + device.Description + ")");
                }
                else
                {
                    Console.WriteLine(" (No description available)");
                }
            }

            int deviceIndex;
            do
            {
                Console.WriteLine("Enter the interface number (1-" + allDevices.Count + "):");
                var deviceIndexString = Console.ReadLine();

                if (!int.TryParse(deviceIndexString, out deviceIndex) || deviceIndex < 1 || deviceIndex > allDevices.Count)
                {
                    deviceIndex = 0;
                }
            }
            while (deviceIndex == 0);

            var selectedDevice = allDevices[deviceIndex - 1];

            using (var communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
            {
                Console.WriteLine("Listening on " + selectedDevice.Description + "...");

                communicator.ReceivePackets(0, packet => PacketHandler(selectedDevice, packet));
            }
        }

        private static void PacketHandler(PacketDevice device, Packet packet)
        {
            Console.WriteLine("[{0}] {1} {2}", device.Name, packet.Timestamp.ToString("hh:mm:ss.fff"), packet.Length);
        }
    }
}

1. rpcap://\Device\NPF_{0CDD10C5-9C40-47BD-811D-7CD24547CD28} (Network adapter 'Microsoft' on local host)
2. rpcap://\Device\NPF_{3C97403E-012B-4912-96B1-F8E246F93BA0} (Network adapter 'Sun' on local host)
3. rpcap://\Device\NPF_{06217B0B-1804-4ADD-9BEE-4A7EBC63B009} (Network adapter 'Microsoft' on local host)
4. rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09} (Network adapter 'Intel(R) 82579LM Gigabit Network Connection' on local host)
5. rpcap://\Device\NPF_{40199909-A7A1-4549-8D06-9DCE66F24A7E} (Network adapter 'Microsoft' on local host)

Enter the interface number (1-5): 4

Listening on Network adapter 'Intel(R) 82579LM Gigabit Network Connection' on local host...
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.552 55
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.552 60
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.848 60
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.848 54
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.958 55
[rpcap://\Device\NPF_{C189488C-4DD5-4410-981B-A5929234AC09}] 01:59:49.958 55

识别数据包来自 pcap.net 中的接口？

Recognizing the interface that a packet comes from in pcap.net?

c#

windows

network-programming

pcap.net