用java解析抓包文件

使用依赖包

<dependency>
    <groupId>io.pkts</groupId>
    <artifactId>pkts-core</artifactId>
    <version>3.0.0</version>
    <type>jar</type>
</dependency>

<dependency>
    <groupId>io.pkts</groupId>
    <artifactId>pkts-streams</artifactId>
    <version>3.0.0</version>
    <type>jar</type>
</dependency>

demo核心代码

public class Main {
    public static void main(String[] args) throws IOException {
        final Pcap pcap = Pcap.openStream("tcpdump.pcap");
        pcap.loop(new PacketHandler() {
            @Override
            public boolean nextPacket(Packet packet) throws IOException {
                if (packet.hasProtocol(Protocol.TCP)) {
                    TCPPacket tcpPacket = (TCPPacket) packet.getPacket(Protocol.TCP);
                    Buffer buffer = tcpPacket.getPayload();
                    if (buffer != null) {
                        System.out.println("TCP: " + buffer);
                    }
                } else if (packet.hasProtocol(Protocol.UDP)) {
                    UDPPacket udpPacket = (UDPPacket) packet.getPacket(Protocol.UDP);
                    Buffer buffer = udpPacket.getPayload();
                    if (buffer != null) {
                        System.out.println("UDP: " + buffer);
                    }
                }
                return true;
            }
        });
    }
}

使用小结

默认的解析协议不多，但提供Buffer进行继续解析。
协议的定义很清晰，算是顺带复习计算机网络基础
使用API有限，也够用。
分析数据还是用wireshark
只是需要把数据以binany的方式批量处理，需要编程处理。

PCAP("pcap", Layer.LAYER_1),
ETHERNET_II("eth", Layer.LAYER_2, 1L),
SLL("sll", Layer.LAYER_2, 113L),
ICMP("icmp", Layer.LAYER_3),
IGMP("igmp", Layer.LAYER_3),
IPv4("ip", Layer.LAYER_3, 101L),
TCP("tcp", Layer.LAYER_4),
UDP("udp", Layer.LAYER_4),
SCTP("sctp", Layer.LAYER_4),
TLS("tcp", Layer.LAYER_7),
SIP("sip", Layer.LAYER_7),
SDP("sdp", Layer.LAYER_7),
RTP("rtp", Layer.LAYER_7),
RTCP("rtcp", Layer.LAYER_7),

最后一个标号的参数是链路类型
https://www.tcpdump.org/linktypes.html

参考

参考：https://www.javahelps.com/2017/08/parse-pcap-files-in-java.html
参考：https://github.com/slgobinath/Java-Helps-Java/tree/master/library/PCAP-Parser