首页 > 代码库 > 承载于以太网帧之上的数据包的解析——ARP、IPv4、IPv6
承载于以太网帧之上的数据包的解析——ARP、IPv4、IPv6
承接上一博文而来,继续解析网络数据包,对于承载在以太网上的三种协议进行了解析,主要是分为根据RFC定义的标准先解析头部数据,然后得到有效载荷,即为协议包含的实体数据,更上层进行进一步处理。
一、ARP协议
该协议作为局域网IP地址和MAC地址映射的重要协议,与DNS将域名与IP地址进行映射有异曲同工之妙。当以太网的类型字段为 0x0806时即为ARP协议数据包。定义如下图:
硬件类型即为以太网的代码。ARP支持的协议类型为IP(0x0800),硬件地址长度即MAC地址长度为6,协议地址长度为IP地址长度为4,OP字段为当前数据报的类型,0x0001表示请求包,0x0002表示应答包。这些就构成了ARP数据报头,一共8个Byte。
随后的20个Byte分别如上图所示,用来进行MAC地址和IP地址映射。
解析如下:
/// <summary> /// Define the ARP packet header by RFC826 /// </summary> public class ARPPacketHeader : INetworkLayerHeader { public ushort HardwareType = 0; //2 Bytes 硬件类型 public ushort ProtocalType = 0; //2 Bytes 协议类型 public byte HardwareAddressLength = 6; //1 Byte 硬件地址长度(即MAC地址长度为6) public byte ProtocolAddressLength = 4; //1 Byte 协议地址长度(即IP地址长度为4) public ushort OP = 0; //2 Byte ARP包类型(0x0001:请求包 0x0002:应答包) } /// <summary> /// Parse the ARP packet /// </summary> public class ARPPacket : INetworkLayerPacket { private byte[] RawPacket; public ARPPacketHeader Header; public string SenderMAC; public string SenderIP; public string ReceiverMAC; public string ReceiverIP; public ARPPacket(byte[] rawArpPacket) { SenderMAC = Util.JoinByteArr(Util.SubByteArr(rawArpPacket, 8, 6), "-"); SenderIP = Util.JoinByteArr(Util.SubByteArr(rawArpPacket, 14, 4), ".", "d"); ReceiverMAC = Util.JoinByteArr(Util.SubByteArr(rawArpPacket, 18, 6), "-"); ReceiverIP = Util.JoinByteArr(Util.SubByteArr(rawArpPacket, 24, 4), ".", "d"); RawPacket = rawArpPacket; } public INetworkLayerHeader getHeader() { Header = new ARPPacketHeader(); Header.HardwareType = (ushort)((ushort)(RawPacket[0] << 8) + (ushort)RawPacket[1]); Header.ProtocalType = (ushort)((ushort)(RawPacket[2] << 8) + (ushort)RawPacket[3]); Header.HardwareAddressLength = (byte)RawPacket[4]; Header.ProtocolAddressLength = (byte)RawPacket[5]; Header.OP = (ushort)((ushort)(RawPacket[6] << 8) + (ushort)RawPacket[7]); return Header; } public byte[] getBody() { return Util.SubByteArr(RawPacket, 8); } }
二、IPv4协议
解析过程与上述类似,可以进行类比。作为最广泛的网络层协议,详细结构就不赘述。直接看结构图:
解析过程如下:
/// <summary> /// Define the IPv4 packet header by RFC791 /// </summary> public class IPv4PacketHeader : INetworkLayerHeader { public byte Version = 4; //3 bits 版本号 public byte Length = 0; //5 bits 头部长度 public byte Tos = 0; //1 Byte 服务类型 public ushort DatagramLength = 0; //2 Bytes 数据包长度 public ushort Identification = 0; //2 Bytes 标识 public byte Mark = 0; //3 bits 标志 public ushort Offset = 0; //13 bits 片偏移 public byte TTL = 0; //1 Byte 数据包寿命 public byte UpperProtocal = 0; //1 Byte 上层协议 public ushort HeaderChecksum = 0; //2 Byte 头部检查和 public string SrcIP = ""; //4 Bytes 源IP地址 public string DstIP = ""; //4 Bytes 目的IP地址 } /// <summary> /// Parse the IPv4 packet /// </summary> public class IPv4Packet : INetworkLayerPacket { private byte[] RawPacket; public IPv4PacketHeader Header; public byte[] Body; public IPv4Packet(byte[] rawPacket) { RawPacket = rawPacket; } public INetworkLayerHeader getHeader() { Header = new IPv4PacketHeader(); Header.Length = (byte)(RawPacket[0] & 0x1f); Header.Tos = RawPacket[1]; Header.DatagramLength = (ushort)((ushort)(RawPacket[2] << 8) + (ushort)RawPacket[3]); Header.Identification = (ushort)((ushort)(RawPacket[4] << 8) + (ushort)RawPacket[5]); Header.Mark = (byte)(RawPacket[6] >> 5); Header.Offset = (ushort)((ushort)((RawPacket[6] & 0x1f) << 8) + (ushort)RawPacket[7]); Header.TTL = RawPacket[8]; Header.UpperProtocal = RawPacket[9]; Header.HeaderChecksum = (ushort)((ushort)(RawPacket[10] << 8) + (ushort)RawPacket[11]); Header.SrcIP = Util.JoinByteArr(Util.SubByteArr(RawPacket, 12, 4), ".", "d"); Header.DstIP = Util.JoinByteArr(Util.SubByteArr(RawPacket, 16, 4), ".", "d"); return Header; } public byte[] getBody() { Body = Util.SubByteArr(RawPacket, 20); return Body; } }
三、IPv6协议
IPv6是用来替代IPv4以解决地址空间不足的问题而发展起来的,同时改协议在IPv4的基础上也做了很大其他方面的改动,如不允许在中间路由器上进行分片操作等。目前应用范围虽然难以达到取代IPv4的程度,但是提供了较大优势。下图为其数据报结构:
解析过程如下:
/// <summary> /// Define the IPv6 packet header by RFC 2460 /// </summary> public class IPv6PacketHeader : INetworkLayerHeader { public byte Version = 6; //3 bits 版本号 public byte Tos = 0; //1 Byte 流量(服务)类型 public uint FlowTag = 0; //21 bits 流标签 public ushort AvaiLoad = 0; //2 Bytes 有效载荷长度 public byte NextHeader = 0; //1 Byte 下个首部(与IPv4中的协议字段值相同) public byte HopLimit = 0; //1 Byte 跳数限制 public string SrcIP = ""; //16 Bytes 源IPv6地址 public string DstIP = ""; //16 Bytes 目的IPv6地址 } /// <summary> /// Parse the IPv6 packet /// </summary> public class IPv6Packet : INetworkLayerPacket { private byte[] RawPacket; public IPv6PacketHeader Header; public byte[] Body; public IPv6Packet(byte[] rawPacket) { RawPacket = rawPacket; } public INetworkLayerHeader getHeader() { Header = new IPv6PacketHeader(); Header.Tos = (byte)((RawPacket[0] & 0x1fu) << 3 + RawPacket[1] >> 5); Header.FlowTag = (uint)((RawPacket[1] & 0x1fu) << 16 + RawPacket[2] << 8 + RawPacket[3]); Header.AvaiLoad = (ushort)((ushort)(RawPacket[4] << 8) + (ushort)RawPacket[5]); Header.NextHeader = RawPacket[6]; Header.HopLimit = RawPacket[7]; Header.SrcIP = Util.JoinByteArr(Util.SubByteArr(RawPacket, 8, 16), ":", "X2", 2); Header.DstIP = Util.JoinByteArr(Util.SubByteArr(RawPacket, 24, 16), ":", "X2", 2); return Header; } public Byte[] getBody() { Body = Util.SubByteArr(RawPacket, 40); return Body; } }
通过对这些协议的亲自剖析,可以更加对网络传输有了更深的理解,同时对应用层的应用开发也有很好的指导作用。
承载于以太网帧之上的数据包的解析——ARP、IPv4、IPv6
声明:以上内容来自用户投稿及互联网公开渠道收集整理发布,本网站不拥有所有权,未作人工编辑处理,也不承担相关法律责任,若内容有误或涉及侵权可进行投诉: 投诉/举报 工作人员会在5个工作日内联系你,一经查实,本站将立刻删除涉嫌侵权内容。