SharpPcap을 이용한 패킷분석 프로그램 제작

 

 

 

 

 

 

먼저 와이어샤크를 통해 패킷분석을 먼저 한다

그래야 좀 편하다

https://wmmu.tistory.com/entry/%EC%99%80%EC%9D%B4%EC%96%B4%EC%83%A4%ED%81%AC%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%9C-%ED%8C%A8%ED%82%B7%EB%B6%84%EC%84%9D

와이어샤크를 이용한 패킷분석

 

 

 

 

 

 

 

 

 

 

 

윈폼 프로젝트 셋업을 한다

 

SharpPcap Nuget을 설치

 

샘플들은 이곳에서 볼수있다

https://github.com/dotpcap/sharppcap

GitHub - dotpcap/sharppcap: Official repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing

 

 

 

 

샘플코드

https://gist.github.com/ahzkwid/f0d9f01fdf41e7d3cfd4f6ace0438f92

using System.Diagnostics;
using SharpPcap;
using SharpPcap.LibPcap;

namespace Ahzkwid
{
    public class PacketCapture
    {
        private LibPcapLiveDevice[] devices;

        public PacketCapture()
        {

            var devices = LibPcapLiveDeviceList.Instance.ToList();

            // IP가 있는 장치만 필터링해서 재할당
            //devices = devices.FindAll(dev => dev.Addresses.Any(a => a.Addr.ipAddress.AddressFamily == AddressFamily.InterNetwork));

            devices = devices
            .FindAll(dev =>
            {
                var lowerName = dev.Description.ToLower();
                if (lowerName.Contains("loopback") && lowerName.Contains("capture"))
                {
                    return false;
                }
                return true;
            });

            Debug.WriteLine("장치 목록");
            for (int i = 0; i < devices.Count; i++)
            {
                var device = devices[i];
                var address = device.Addresses.Select(a => a.Addr);
                Debug.WriteLine($"[{i}] {device.Description} - Address: {string.Join(", ", address)}");
            }

            this.devices = devices.ToArray();
        }

        public void Start()
        {
            Debug.WriteLine("패킷 캡처 시작.");
            foreach (var device in devices)
            {
                device.Open(DeviceModes.Promiscuous, 1000);
                device.OnPacketArrival += (sender, e) =>
                {
                    var data = e.GetPacket().Data;
                    Debug.WriteLine($"{System.DateTime.Now} : {BitConverter.ToString(data).Replace("-", " ")}");
                };
                device.StartCapture();
            }
        }

        public void Stop()
        {
            foreach (var device in devices)
            {
                device.StopCapture();
                device.Close();
            }
            Debug.WriteLine("패킷 캡처 종료.");
        }
    }
}

 

위 코드를 넣고

 

아래처럼 넣어주면 된다

public partial class Form1 : Form
{
    private Ahzkwid.PacketCapture packetCapture;
    public Form1()
    {
        InitializeComponent();

        packetCapture = new Ahzkwid.PacketCapture();
        packetCapture.Start();
    }

    private void Form1_FormClosing(object sender, FormClosingEventArgs e)
    {
        packetCapture?.Stop();
    }
}

 

 

 

그러면 아래와 같이 패킷들이 나오고

입맛에 맞게 필터링을 걸거나 추출하면 된다