Summary of issues to be noted during network programming

1. Network programming When you define a structure to implement the protocol, be sure to pay attention to the problem of byte alignment. Otherwise, the sizeof and the cast pointers will be hard to find.

What is byte alignment self-Baidu.

1 #pragmaPack (1)//byte-aligned control! Very careful! 2 //define an Ethernet header3typedefstructEHHDR4 5 {6 7UCHAR eh_dst[6];/*Destination Ethernet addrress*/8 9UCHAR eh_src[6];/*Source Ethernet Addresss*/Ten  OneUSHORT Eh_type;/*Ethernet Pachet Type*/ A  - }etherhead; -  the //28-byte ARP request/reply -  -typedefstructARPHDR -  + { -  +USHORT ARP_HRD;/*format of hardware address*/ A  atUSHORT Arp_pro;/*format of protocol address*/ -  -UCHAR ARP_HLN;/*length of hardware address*/ -  -UCHAR ARP_PLN;/*length of protocol address*/ -  inUSHORT Arp_op;/*Arp/rarp Operation*/ -  toUCHAR arp_sha[6];/*Sender Hardware Address*/ +  -ULONG Arp_spa;/*Sender Protocol Address*/ the  *UCHAR arp_tha[6];/*Target Hardware address*/ $ Panax NotoginsengULONG ARP_TPA;/*Target Protocol Address*/ -  the }arphead; +  A #pragmaPack ()//control of Byte alignment

2. Note the conversion of the network byte order and the native byte order. Use functions such as Ntohs (). The following is an example of a WinPcap callback function that detects if the machine is doing an ARP scan, and any suggestions for the code are welcome to indicate communication.

1 voidPacket_handler_arp (U_char *param,Const structPcap_pkthdr *header,ConstU_char *pkt_data)2 {3     structTM *Ltime;4Ltime =New structTM;5     Chartimestr[ -];6 time_t local_tv_sec;7time_t TTimer = Time (0);8     StaticUnsigned ShortNnum;9 Ten     if(Ttimer-g_tstarttimer > Sniff_time)//Timing Sniffing Time One Pcap_breakloop (G_opendev); A  -     /*convert timestamps to recognizable formats*/ -Local_tv_sec = header->ts.tv_sec; theLocaltime_s (Ltime, &local_tv_sec); -Strftime (TIMESTR,sizeofTIMESTR,"%h:%m:%s", ltime); -      -printf"%s,%.6d len:%d\n", Timestr, Header->ts.tv_usec, header->len); +  -     //sniff out if you're sending out ARP +Etherhead *petherhead =NULL; APetherhead = (etherhead*) Pkt_data; at     if(STRNCMP (Const Char*) (PETHERHEAD->EH_SRC), (Const Char*) (G_AMAC),6) ==0) {//detects if the source address is native -Arphead *parphead =NULL; -         //printf ("is the ARP data emitted by this machine"); -Parphead = (arphead*) (Pkt_data +sizeof(Etherhead)); -         if(Ntohs (parphead->arp_pro) = =0x0800&&//IP -Ntohs (parphead->arp_op) = =0x0001&&//ARP Request in(Ntohl (PARPHEAD->ARP_TPA) &0xffff0000)==0xc0a80000) {//is the ARP request intranet IP -Nnum + +; to                 //printf ("Count +1\n"); +                 if(Nnum > Warn_num) {//The count exceeds the threshold parameter -G_bwarning =true; the Pcap_breakloop (G_opendev); *                 } $         }Panax Notoginseng     } -      the      +}

Summary of issues to be noted during network programming