正文

為了彌補pcap文件的缺陷，讓抓包文件可以容納更多的信息，pcapng格式應運而生。關於它的介紹詳見《PCAP Next Generation Dump File Format》

        形而上的論述就不多談了，直接給出一個pcapng數據包文件的例子：

然後我強烈建議，對著《PCAP Next Generation Dump File Format》來把一個實際抓取的pcapng文件裏面的每一個字節都對應清除，接下來寫一個python腳本，手工構造一個這樣的文件，可以用wireshark打開並解析的那種(其實這並不是一件特別難的事情)。這樣你就算徹底掌握了這個格式。

#!/usr/bin/python

# Default tcpdump buffer size seems to 2M

import sys
import socket
import struct

filename = sys.argv[0]
filename = sys.argv[1]
#print filename
ipaddr = sys.argv[2]
direction = sys.argv[3]

packed = socket.inet_aton(ipaddr)
ip32 = struct.unpack("!L", packed)[0]

file = open(filename, "rb") 

pkthdrlen=16
iphdrlen=20
tcphdrlen=20
stdtcp = 20
total = 0
pos = 0

start_seq = 0
end_seq = 0

# Read file header(type and size)
typedata = http://blog.csdn.net/dog250/article/details/file.read(8)
(type, size) = struct.unpack("=LL", typedata)

# Skip header description
skipdata = file.read(size-8)

# Read interface desc block
interfacedata = file.read(8)
(type, size) = struct.unpack("=LL", interfacedata)

# Get linktype from int-desc block
ltdata = file.read(4)
(type, ltsize) = struct.unpack("=HH", ltdata)
if ltsize == 0x71:
	pkthdrlen = 16
else:
	pkthdrlen = 14

# Skip other of int-desc block
skipdata = file.read(size-8-4)

# Read packet block
pktdata = file.read(8)
(type, size) = struct.unpack("=LL", pktdata)

ipcmp = 0
cnt = 0

while pktdata:
	# Skip Interface ID
	skipdata = file.read(4)

	# Get time and length
	# sec:
	# microsec:
	# iplensave:
	# origlen:
	data = file.read(16)
	(sec, microsec, iplensave, origlen) = struct.unpack("=LLLL", data)

	# Read linklayer
	linkdata = file.read(pkthdrlen)
	

	# Read IP header
	ipdata = file.read(iphdrlen)
	(vl, tos, tot_len, id, frag_off, ttl, protocol, check, saddr, daddr) = struct.unpack(">ssHHHssHLL", ipdata)
	iphdrlen = ord(vl) & 0x0F 
	iphdrlen *= 4

	# Read TCP standard header
	tcpdata = file.read(stdtcp)	
	(sport, dport, seq, ack_seq, pad1, win, check, urgp) = struct.unpack(">HHLLHHHH", tcpdata)
	tcphdrlen = pad1 & 0xF000
	tcphdrlen = tcphdrlen >> 12
	tcphdrlen = tcphdrlen*4
	
	if direction =='out':
		ipcmp = saddr
	else:
		ipcmp = daddr

	if ipcmp == ip32:
		cnt += 1
		total += tot_len
		total -= iphdrlen + tcphdrlen
		if start_seq == 0:  # BUG?
			start_seq = seq
		end_seq = seq

	# Skip options and data
	skipdata = http://blog.csdn.net/dog250/article/details/file.read(size - 8 - 4 - 16 - pkthdrlen - iphdrlen - stdtcp)
	
	# Read next packet
	pos += 1
	pktdata = file.read(8)
	(type, size) = struct.unpack("=LL", pktdata)
	if type <> 0x06:
		break
# Get interface statistics
if type == 0x05:
	skiphdr = file.read(12)
	opthdr = file.read(4)
	(code, length) = struct.unpack("=HH", opthdr)

	while length <> 0:
		# 32-bit boundary! BUG?

		if code == 5:
			opt = file.read(length)
			(drops,) = struct.unpack("=Q", opt)
			# 不能這麽將丟棄的數據包算進去！抓包時就這一個流嗎？每個被丟棄的包都是攜帶數據的嗎？...
			# 所以，pcapng僅僅統計被丟棄的數據包的數量，不夠！怎麽才夠？不知道！！
#			total += drops*1460
	
		elif code == 7:
			opt = file.read(length)
			(drops,) = struct.unpack("=Q", opt)
#			total += drops*1460

		else:
			skipopt = file.read(length)
		opthdr = file.read(4)
		(code, length) = struct.unpack("=HH", opthdr)
		

print pos,'Actual:'+str(total),  'ideal:'+str(end_seq-start_seq)

附錄

抓包丟棄的問題：dropped by kernel釋義與避免

        pcapng可以把抓包過程中被丟棄的數據包的數量統計在一個section裏最終導出給用戶看，我們註意到pcapng文件格式的section類型中有一個”Interface Statistics Block“的可選字段，其中統計了在整個抓包過程中的以下信息：

        但是這些夠了嗎？

        總有人質疑，這是人之本性，我是人，我也會這樣，這是亞裏士多德的理論，是嗎？是的！由於抓包丟失我無法統計出精確的數據包發送的數值，誰能精確統計以及怎麽統計？請回答，如果不能回答，請沈默。

        我不沈默，因為我有辦法統計。我可以對照TCP的序列號，就像wireshark發現抓包丟失那樣發現抓包丟失，但是我並不認為這是有用的，這毫無意義！

pcapng的統計補遺

pcap與pcapng之間的轉換

文章來源：