(Network packet capture and analysis technology is the basis for the implementation of many network security software, and also the basis for the design of network analysis software. The implementation of some existing technologies such as firewall, protocol analysis and other software is based on the sniffing and capture of data packets. Therefore, the research on relevant packet capture and analysis technology is of great practical significance to ensure the safe operation of the network. This paper makes an in-depth study on the network monitoring and protocol analysis technology based on WinPcap under windows, studies the framework of WinPcap in detail, obtains the general process of development based on WinPcap driver, and finally realizes a packet capture parser capturepacket. The target of network monitoring in the program is ARP, IP, TCP, UDP a protocols in tcp/ip protocol. Based on WindowsXP operating system and in visualc++ environment, WinPcap driver is used to capture the original data packets from the data link layer of tcp/ip protocol stack, and extract the data of the above four protocols and data packets. Through testing in the actual environment, it is proved that the system can efficiently monitor and hear data packets that are consistent with the set filtering conditions, and display the protocol, source IP address, destination IP address, packet length and data in each packet, which can help network managers analyze network data and has certain practical value, It is mainly manifested in the following aspects: (1) first, it realizes the free choice of all network cards on the machine. (2) It realizes the custom packet filtering rules, which can bind the host, protocol and port at the same time, can listen to some types of packets pertinently, and can display the protocol hierarchy in the form of protocol tree. (3) Capture and analyze Ethernet link layer frames, and support ARP, IP, TCP and UDP protocols. (4) Realize the hexadecimal and ASCII code display of the captured data. Keywords: packet capture; WinPcap； Protocol analysis; Tcp/ip protocol; VC++6.0)
收藏
