因广大VB爱好者开发捕获IP数据包的需要，我花了一个下午的工夫，终于把它整里出来了，由于时间关系，以下的数据分析部分写的不是很详细。以下代码在WIN98+VB6.0上测试通过，主函数部分比较简单，1。打开设备驱动程序，2。绑定网卡，3。设置捕获数据，4。循环截获IP包。
　　由于在WIN98下捕获IP数据包，必须要使用VXD技术，它不像WIN2000（可以参照前二天写的，“使用VB捕获WIN2000下的IP数据包”），捕获IP数据包不需要VXD文件，单单只要使用VB就可以了。因为编写VXD的步骤比较麻烦，在以下的源代码中，直接使用IPMAN中的VPACKET.VXD这个驱动程序。可以在网上比较容易得到，需要的朋友也可以跟我联系。以下包含了截获数据包的所有源代码，只要把下面的代码放到一个模块（.BAS）文件中就可以了，里面信息截获到以后，并没有对数据做太多的处理，所有的数据都放在OutBuff数组中，只是简单的分离出了以太网头部m_EtherPacketHead，IP包头部m_IPPacketHead，其中程序中只是简单的输出了源IP地址，目的IP地址，需要更进一不分析里面的内容，可以参照别的资料。在这里为了程序尽量的简单，所以不过多的牵涉。进一步分析的内容可以添加到输出内容的附近代码就可以了。
　　'--------源代码开始，放到.bas中即可以测试----------
　　Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
　　Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, lpSecurityAttributes As Long, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As Long) As Long
　　Private Declare Function CreateEvent Lib "kernel32" Alias "CreateEventA" (ByVal lpEventAttributes As Long, ByVal bManualReset As Long, ByVal bInitialState As Long, ByVal lpName As String) As Long
　　Private Declare Function WaitForMultipleObjectsEx Lib "kernel32" (ByVal nCount As Long, lpHandles As Long, ByVal bWaitAll As Long, ByVal dwMilliseconds As Long, ByVal bAlertable As Long) As Long
　　Private Const INFINITE = &HFFFF
　　Private Const GENERIC_WRITE = &H40000000
　　Private Const GENERIC_READ = &H80000000
　　Private Const OPEN_EXISTING = 3
　　Private Const FILE_ATTRIBUTE_NORMAL = &H80
　　Private Const FILE_FLAG_OVERLAPPED = &H40000000
　　Private Const FILE_FLAG_DELETE_ON_CLOSE = &H4000000
　　Private Const ERROR_IO_INCOMPLETE = 996&
　　Private Const NDIS_PACKET_TYPE_DIRECTED = &H1
　　Private Const IOCTL_PROTOCOL_SET_OID = &H80000004
　　Private Const IOCTL_PROTOCOL_READ = &H80000010
　　Private Const OID_GEN_CURRENT_PACKET_FILTER = &H1010E
　　Private Const WAIT_FAILED = -1
　　Private Type OVERLAPPED
　　Internal As Long
　　InternalHigh As Long
　　offset As Long
　　OffsetHigh As Long
　　hEvent As Long
　　End Type
　　Type EtherAddr
　　AddrByte1 As Byte
　　AddrByte2 As Byte
　　AddrByte3 As Byte
　　AddrByte4 As Byte
　　AddrByte5 As Byte
　　AddrByte6 As Byte
　　End Type
　　Type EtherPacketHead
　　DestEther As EtherAddr
　　SourEther As EtherAddr
　　ServType As Integer
　　End Type
　　Type IPAddr
　　AddrByte(0 To 3) As Byte
　　End Type
　　Type IPPacketHead
　　VerHLen As Byte
　　Type1 As Byte
　　TtlLen As Integer
　　Id As Integer
　　FlgOff As Integer
　　TTL As Byte
　　Proto As Byte
　　ChkSum As Integer
　　SourIP As IPAddr
　　DestIP As IPAddr
　　End Type
　　Type PACKET_OID_DATA
　　Oid As Long
　　Length As Long
　　data As Byte
　　End Type
　　Private Declare Function DeviceIoControlAsString Lib "kernel32" Alias "DeviceIoControl" (ByVal hDevice As Long, ByVal dwIoControlCode As Long, ByVal lpInBuffer As String, ByVal nInBufferSize As Long, ByVal lpOutBuffer As String, ByVal nOutBufferSize As Long, lpBytesReturned As Long, lpOverlapped As OVERLAPPED) As Long
　　Private Declare Function DeviceIoControl Lib "kernel32" (ByVal hDevice As Long, ByVal dwIoControlCode As Long, lpInBuffer As Any, ByVal nInBufferSize As Long, lpOutBuffer As Any, ByVal nOutBufferSize As Long, lpBytesReturned As Long, lpOverlapped As OVERLAPPED) As Long
　　Private Declare Function GetOverlappedResult Lib "kernel32" (ByVal hFile As Long, lpOverlapped As OVERLAPPED, lpNumberOfBytesTransferred As Long, ByVal bWait As Long) As Long
　　Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
　　Private Declare Sub ZeroMemory Lib "kernel32" Alias "RtlZeroMemory" (ByVal dest As Long, ByVal numbytes As Long)
　　Private Declare Function GetLastError Lib "kernel32" () As Long
　　Const ETHER_PROTO_IP = &H8
　　Const IP_PROTO_TCP = &H6
　　Const ETHER_HEAD_LEN = 14
　　Const IP_HEAD_BYTE_LEN = 20
　　Dim bFirst As Boolean
　　Const SYSERR = -1
　　Const BUFFER_SIZE = 16384
　　Const nREAD = 1
　　Type PacketTable
　　hEvent As Long
　　Active As Boolean
　　Overlap As OVERLAPPED
　　Size As Long
　　Buffer(BUFFER_SIZE) As Byte
　　Length As Long
　　Type As Integer
　　End Type

上一页12345下一页