Jnetpcap quickguide

jnetpcap 개발가이드
java network packet capture api
(jnetpcap)
Quick start guide
Originated by http://jnetpcap.com/
darkandark90@gmail.com

Revision History
2013.05.05 first commit

Target Audience
• 네트워크 프로그래밍을 하는 사람.
• wireshark 쓰는 게 버거운 사람.
• 개발서버가 없어서 고객 실서버에서 뭔가
해결해야 하는 사람(welcome to hell)
- play network programing
- want to have to make personalization
network capture tool

Test version
JDK 1.7 64bit
jnetpcap-1.3.b4-1.win64.zip
-jdk버전은 상관없음. 1.6 32bit 권장
일반적으로 대상장비들이 32bit lpv4
신형장비인 경우 64bit ipv6 인 경우가 많으므로
만약 상업적으로 뭔가를 한다면 그냥 32bit 추천
유사 라이브러리
- winpcap
- jpcap

개발환경 세팅#1
http://sourceforge.net/projects/jnetpcap/?sou
rce=recommended
sourceforge에서 다운로드
압축을 풀어서 jnetpcap.dll 파일을 windows
에 System32폴더에 복사

eclipse설정
AddLibrary클
릭
완성된 화면

user library선택

User
Libraries 클
릭

New 클릭

이름은 상관없음.
체크박스에 반드시 체
크

• Add jars
클릭
jnetpcap.ja
r 파일 추가

Api 사용 장비 조회
존재여부
//network device저장용
• List<PcapIf> alldevs = new ArrayList<PcapIf>();
• StringBuilder errbuf = new StringBuilder();
• int r = Pcap.findAllDevs(alldevs, errbuf);
• if (r == Pcap.NOT_OK || alldevs.isEmpty()) {
• System.err.printf("Can't read list of
devices, error is %s", errbuf
• .toString());
• return;
• }

장비조회 #2
존재하는 경우
PcapIf.getName()
PcapIf.getDescription()
이용

Device 조회결과
• #0: DeviceNPF_{940F2889-F79F-4438-807C-
E745A91C0F2F} [VMware Virtual Ethernet
Adapter]
• #1: DeviceNPF_{47CC0E79-D78A-42F0-8A78-
7104AB62AA48} [Realtek PCIe GBE Family
Controller]
• #2: DeviceNPF_{F04CEA22-A7CC-406A-A27E-
BF440554CBB6} [Realtek PCIe GBE Family
Controller]
• #3: DeviceNPF_{C2E8FF15-D8A3-4320-A70B-
011511818BC5} [VMware Virtual Ethernet Adapter]

packet capture api
PcapPacketHandler이용
• JPacketHandler<String> jpacketHandler = new
JPacketHandler<String>() {
• @Override
• public void nextPacket(JPacket packet, String user) {
• final JCaptureHeader header = packet.getCaptureHeader();
• System.out.printf( "packet caplen=%d wiredlen=%dn",
header.caplen(), header.wirelen());
• System.out.println(packet.toString());
• }
• };
• pcap.loop(10, jpacketHandler, "jpacket test");
• }

packet capture 결과
• packet caplen=66 wiredlen=66
• Frame:
• Frame: number = 0
• Frame: timestamp = 2013-05-05 01:56:06.805
• Frame: wire length = 66 bytes
• Frame: captured length = 66 bytes
• Frame:
• Eth: ******* Ethernet - "Ethernet" - offset=0 (0x0) length=14
• Eth:
• Eth: destination = 72:08:17:18:2e:23
• Eth: .... ..0. .... .... = [0] LG bit
• Eth: .... ...0 .... .... = [2] IG bit
• Eth: source = 00:25:22:a4:93:fe
• Eth: .... ..0. .... .... = [0] LG bit
• Eth: .... ...0 .... .... = [2] IG bit
• Eth: type = 0x800 (2048) [ip version 4]
• Eth:
• Ip: ******* Ip4 - "ip version 4" - offset=14 (0xE) length=20 protocol suite=NETWORK
• Ip:
• Ip: version = 4
• Ip: hlen = 5 [5 * 4 = 20 bytes, No Ip Options]
• Ip: diffserv = 0x0 (0)
• Ip: 0000 00.. = [0] code point: not set
• Ip: .... ..0. = [0] ECN bit: not set
• Ip: .... ...0 = [0] ECE bit: not set
• Ip: length = 52
• Ip: id = 0x14DB (5339)
• Ip: flags = 0x2 (2)
• Ip: 0.. = [0] reserved
• Ip: .1. = [1] DF: do not fragment: set
• Ip: ..0 = [0] MF: more fragments: not set
• Ip: offset = 0
• Ip: ttl = 128 [time to live]
• Ip: type = 6 [next: Transmission Control]
• Ip: checksum = 0x0 (0) [incorrect: 0x4EA0]
• Ip: source = 192.168.219.5
• Ip: destination = 116.34.135.120
• Ip:
• Tcp: ******* Tcp offset=34 (0x22) length=32 중략….

미결..
filter 쓰는 방법을 추가해야 함…

Jnetpcap quickguide

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (19)

Ähnlich wie Jnetpcap quickguide

Ähnlich wie Jnetpcap quickguide (20)

Mehr von Sukjin Yun

Mehr von Sukjin Yun (20)

Jnetpcap quickguide