登录
当前位置： 首页 > 工具软件 > PDML > 使用案例 >

wiresharp截包pdml文件分析php程序

壤驷瑾瑜
2023-12-01 
<?php

require_once 'XByteArray.php';
require_once 'http.php';

class MyPacket
{
		public $port_src  = 0;
		public $ip_src    = 0;
		public $port_dst  = 0;
		public $ip_dst    = 0;
		public $tcp_flags = 0;
		public $tcp_flags_res     = 0;
		public $tcp_flags_ns     = 0;
		public $tcp_flags_cwr     = 0;
		public $tcp_flags_ecn     = 0;
		public $tcp_flags_urg     = 0;
		public $tcp_flags_ack     = 0;
		public $tcp_flags_reset   = 0;
		public $tcp_flags_syn     = 0;
		public $tcp_flags_fin     = 0;
		public $tcp_flags_push     = 0;
		
		public $data      = "";
		public $timestamp = 0;
		public $timestamp_name = "";
		public $key = "";
		public $frame_num= 0;
		public $frame_len=0;
		public $frame_caplen=0;
		public function genKey()
		{
			$keyarr =array($this->ip_src.":".$this->port_src, $this->ip_dst.":".$this->port_dst);
			sort($keyarr,SORT_STRING);
			$this->key = implode("<->",$keyarr);
		}
		
		public function dump()
		{
		
			printf("%10d ", $this->frame_num);
			echo $this->timestamp;
			echo " {$this->ip_src}";
			echo ":{$this->port_src}";
			echo "->{$this->ip_dst}";
			echo ":{$this->port_dst}";
			printf(" len %5d ",    $this->frame_len);
			printf(" caplen %5d ", $this->frame_caplen);
			echo " flags ". dechex($this->tcp_flags);
			echo " res {$this->tcp_flags_res}";
			echo " ns {$this->tcp_flags_ns}";
			echo " cwr {$this->tcp_flags_cwr}";
			echo " ecn {$this->tcp_flags_ecn}";
			echo " urg {$this->tcp_flags_urg}";
			echo " ack {$this->tcp_flags_ack}";
			echo " reset {$this->tcp_flags_reset}";
			echo " syn {$this->tcp_flags_syn}";
			echo " fin {$this->tcp_flags_fin}";
			echo " push {$this->tcp_flags_push}";
			echo " data:".strlen($this->data);
			echo "\n";
			
		}
};

class MyHttpRequestAndResponse
{
	const STAT_NONE				  			=0;
	const STAT_REQUEST_FIRST_SENT 			=1;
	const STAT_REQUEST_FIRST_SENT_ACK       =2;
	const STAT_REQUEST_LAST_SENT  			=4;
	const STAT_REQUEST_LAST_SENT_ACK        =8;
	
	const STAT_RESPONSE_FIRST_RECEIVED		=16;
	const STAT_RESPONSE_FIRST_RECEIVED_ACK	=32;
	const STAT_RESPONSE_LAST_RECEIVED		=64;
	const STAT_RESPONSE_LAST_RECEIVED_ACK   =128;
	
	public $host = "";
	public $url = "";
	public $begin_time ="";
	public $request_sent_first_packet_timestamp =0;
	public $request_sent_first_packet_ack_timestamp =0;
	public $request_sent_last_packet_timestamp =0;
	public $request_sent_last_packet_ack_timestamp =0;

	public $response_first_packet_timestamp =0;
	public $response_first_packet_ack_timestamp =0;
	public $response_last_packet_timestamp =0;
	public $response_last_packet_ack_timestamp=0;
	
	public $request_data_length=0;
	public $response_data_length=0;
	public $stat = 0;
	public $need_send_ack = 0;
	
	public $reqdata='';
	
	public $mypacketlist = array();
};


class MyConnection
{
	 const STAT_SENDING_REQUEST = 0;
	 const STAT_WATTING_RESPONSE = 1;
	
	public $packetlist = array();
	public $client_ip ="";
	public $client_port ="";
	public $server_ip ="";
	public $server_port ="";
	public function analize()
	{
		if($this->packetlist[0]->tcp_flags!=0x02)
		{
			echo "legacy connection ".$this->packetlist[0]->key." \n";
			return ;
		}
		
		if(count($this->packetlist)<3 || $this->packetlist[1]->tcp_flags!=0x12 || $this->packetlist[2]->tcp_flags!=0x10)
		{
			echo "connection ".$this->packetlist[0]->key." not establish \n";
		}
		
		$connect_ack_cost   = $this->packetlist[1]->timestamp - $this->packetlist[0]->timestamp;
		$connect_total_cost = $this->packetlist[2]->timestamp - $this->packetlist[0]->timestamp;
		
		
		echo "CONNECT(".$this->packetlist[0]->key.") COST: $connect_total_cost($connect_ack_cost)  \n" ;
		
		
		
		$ctx   = new HttpContext();
		$bufs  = new XAutoBuffer(4096);
		$stat  = MyConnection::STAT_SENDING_REQUEST;
		
		$collectorlist = array();
		
		$collector = new MyHttpRequestAndResponse();
		
		for($i=3;$i<count($this->packetlist);$i++)
		{
			$packet = $this->packetlist[$i]; 
			array_push($collector->mypacketlist,$packet);
			
			if($packet->tcp_flags_ack)
			{
				switch($collector->stat)
				{
					case MyHttpRequestAndResponse::STAT_REQUEST_FIRST_SENT:
					case MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT:
						if(!($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
						{
							if($collector->request_sent_first_packet_ack_timestamp==0)
							{
									$collector->request_sent_first_packet_ack_timestamp = $packet->timestamp;
							}
								
							if($collector->need_send_ack==1)
							{
								
								$collector->request_sent_last_packet_ack_timestamp = $packet->timestamp;
								$collector->stat =MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT_ACK;
							}
							
							$collector->need_send_ack --;
							
						}
					break;
					
					case MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED:
						if(($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
						{
							$collector->response_first_packet_ack_timestamp = $packet->timestamp;
							$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED_ACK;
						}
					break;
					
					
					case MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED:
						if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
						{
							$collector->response_last_packet_ack_timestamp = $packet->timestamp;
							$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED_ACK;
							array_push($collectorlist,$collector);
							$collector = new MyHttpRequestAndResponse();
						}
						
					break;
				}
			}
			
			
			if(strlen($packet->data)>0)
			{
				if($this->client_ip=="")
				{
					$this->client_ip = $packet->ip_src;
					$this->client_port = $packet->port_src;
					$this->server_ip = $packet->ip_dst;
					$this->server_port = $packet->port_dst;
				}
				
				
				//截包缺失处理
				if($stat==MyConnection::STAT_SENDING_REQUEST)
				{
					if(!($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src))
					{
						$collector->request_sent_last_packet_timestamp = $packet->timestamp;
						$collector->request_data_length = $bufs->GetLength();
						$collector->url = $ctx->m_header->status_code;
						$collector->host = $ctx->getHeaderValueByName('Host');
						
						$ctx->reset();
						$bufs->Clear();
					}
				}
				else
				{
					if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
					{
						$collector->stat = MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED;
						$collector->response_last_packet_timestamp = $packet->timestamp;
						$collector->response_data_length = $bufs->GetLength();
						
						$collector->response_last_packet_ack_timestamp = $packet->timestamp;
						$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED_ACK;
						array_push($collectorlist,$collector);
						$collector = new MyHttpRequestAndResponse();
						
						$ctx->reset();
						$bufs->Clear();
					}	
				}
				
				
				if($collector->stat == MyHttpRequestAndResponse::STAT_NONE )
				{
					$collector->stat = MyHttpRequestAndResponse::STAT_REQUEST_FIRST_SENT;
					$collector->begin_time = $packet->timestamp_name;
					$collector->request_sent_first_packet_timestamp = $packet->timestamp; 
				}
				
				if($this->client_ip==$packet->ip_src && $this->client_port == $packet->port_src)
				{
					$collector->need_send_ack ++;
				}
				else
				{
					if($collector->stat < MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED)
					{
						if($collector->request_sent_last_packet_ack_timestamp==0)
						{
							$collector->request_sent_last_packet_ack_timestamp = $collector->request_sent_first_packet_ack_timestamp;
						}
						
						$collector->stat =MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED;
						$collector->response_first_packet_timestamp = $packet->timestamp;
					}
				}
				
				
					
				
				$bytetotal = strlen($packet->data);
				$consumeLen =0;
				$consumeLen = HttpProtocolClient::parseHttp($ctx,$packet->data,$bytetotal,$bufs);
				
				if($consumeLen!=$bytetotal)
				{
				//	var_dump($ctx);
					
					echo "error $consumeLen!=$bytetotal , it is not ok in http\n";
					//$of = fopen("/tmp/httpdata.dump", "wb");
					for($k=0;$k<count($collector->mypacketlist);$k++)
					{
 						$collector->mypacketlist[$k]->dump();
 						
// 						$datalen =  strlen($collector->mypacketlist[$k]->data);
// 						if($datalen>0)
// 						{
// 							fwrite($of, $collector->mypacketlist[$k]->data, strlen($collector->mypacketlist[$k]->data));
// 						}
						
					}
					//fclose($of);
					//exit(0);
					
				}
				
				if($ctx->m_state==HttpProtocolClient::PACKET_COMPLETE)
				{
					if($stat==MyConnection::STAT_SENDING_REQUEST)
					{
						$stat=MyConnection::STAT_WATTING_RESPONSE;
						//echo "request data sent: ". $packet->timestamp_name. ": ". $ctx->m_header->status_code . "\n";
					}
					else
					{
						//echo "response data recv: ". $packet->timestamp_name. ": ". $ctx->m_header->status_code . "\n";
						$stat=MyConnection::STAT_SENDING_REQUEST;
					}
					
				
				
					if($collector->stat < MyHttpRequestAndResponse::STAT_RESPONSE_FIRST_RECEIVED )
					{
						$collector->stat = MyHttpRequestAndResponse::STAT_REQUEST_LAST_SENT;
						$collector->request_sent_last_packet_timestamp = $packet->timestamp;
						$collector->request_data_length = $bufs->GetLength();
						$collector->url = $ctx->m_header->status_code;
						$collector->host = $ctx->getHeaderValueByName('Host');
						$collector->reqdata = $bufs->GetBuffer();
					}
					else
					{
						$collector->stat = MyHttpRequestAndResponse::STAT_RESPONSE_LAST_RECEIVED;
						$collector->response_last_packet_timestamp = $packet->timestamp;
						$collector->response_data_length = $bufs->GetLength();
					}
				
					//var_dump($packet);
					//var_dump($ctx);
					
					$ctx->reset();
					$bufs->Clear();
				}
				
				
			}
			
			
		}
		
		

		
		if(count($collectorlist)==0)
		{
			for($i=0;$i<count($this->packetlist);$i++)
			{
				$this->packetlist[$i]->dump();
			}
		}
		else
		{
// 			for($i=0;$i<3;$i++)
// 			{
// 				$this->packetlist[$i]->dump();
// 			}
			
			foreach($collectorlist as $c)
			{
				
				
				printf("%0.3f REQUEST TOTAL:%0.3f WRITTEN: %0.3f  RESPONSE_FIRST:%0.3f   READ: %.3f DATA:%6d URL: %s  d:%s\n",
						$c->request_sent_first_packet_timestamp,
						$c->response_last_packet_ack_timestamp - $c->request_sent_first_packet_timestamp,  //TOTAL
						$c->request_sent_last_packet_ack_timestamp- $c->request_sent_first_packet_timestamp, //WRITTEN
						$c->response_first_packet_timestamp - $c->request_sent_last_packet_ack_timestamp, //RESPONSE_FIRST
						$c->response_last_packet_timestamp - $c->response_first_packet_timestamp, //READ
						$c->response_data_length, //time
						$c->host . $c->url, //url
						$c->reqdata
						
				);
				
// 				for($i=0;$i<count($c->mypacketlist); $i++)
// 				{
// 					$c->mypacketlist[$i]->dump();
// 				}
			}
		}
		
		
		echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n";
		//var_dump($collectorlist);
		
	}
};


$connections = array();



$doc = simplexml_load_file("xxxxxx");


$simle_packets  = array();

foreach($doc->packet as $packet)
{


    $mypacket = new MyPacket();
	foreach($packet->proto as $proto)
	{
	
		
		if($proto->attributes()->name=='tcp')
		{
		
			foreach($proto->field as  $field)
			{
				$attrs = $field->attributes();
				if($attrs->name=="tcp.srcport")
					$mypacket->port_src = strval($attrs->show);
				else if($attrs->name=="tcp.dstport")
					$mypacket->port_dst = strval($attrs->show);
				else if($attrs->name=="tcp.flags")
				{
					$mypacket->tcp_flags = hexdec($attrs->show);
					foreach($field->field as $flag)
					{
						$fatt = $flag->attributes();
						if($fatt->name=="tcp.flags.fin")
						{
							$mypacket->tcp_flags_fin = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.ack")
						{
							$mypacket->tcp_flags_ack = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.syn")
						{
							$mypacket->tcp_flags_syn = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.reset")
						{
							$mypacket->tcp_flags_reset = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.push")
						{
							$mypacket->tcp_flags_push = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.urg")
						{
							$mypacket->tcp_flags_urg = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.ecn")
						{
							$mypacket->tcp_flags_ecn = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.cwr")
						{
							$mypacket->tcp_flags_cwr = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.ns")
						{
							$mypacket->tcp_flags_ns = intval($fatt->value);
						}
						else if($fatt->name=="tcp.flags.res")
						{
							$mypacket->tcp_flags_res = intval($fatt->value);
						}
						
					}
				}
// 				else if($attrs->name=="tcp.data")
// 				{
// 					$xtmp = str_replace(':',' ',$attrs->show);
// 					$mypacket->data  =  HexStringToBytes($xtmp, strlen($xtmp));
// 				}
				
			}
		}
		else if($proto->attributes()->name=='ip')
		{
			foreach($proto->field as  $field)
			{
				$attrs = $field->attributes();
				if($attrs->name=="ip.src")
					$mypacket->ip_src = strval($attrs->show);
				else if($attrs->name=="ip.dst")
					$mypacket->ip_dst = strval($attrs->show);
			}
		}
		else if($proto->attributes()->name=='geninfo')
		{

			foreach($proto->field as  $field)
			{
				$attrs = $field->attributes();
				if($attrs->name=="timestamp")
				{
					$mypacket->timestamp = doubleval($attrs->value);
					$mypacket->timestamp_name = strval($attrs->show);
				}
				else if($attrs->name=="num")
				{
					$mypacket->frame_num = hexdec($attrs->value);
				}
				else if($attrs->name=="len")
				{
					$mypacket->frame_len = hexdec($attrs->value);
				}
				else if($attrs->name=="caplen")
				{
					$mypacket->frame_caplen  = hexdec($attrs->value);
				}
			}
		}
		else if($proto->attributes()->name=='fake-field-wrapper')
		{
			foreach($proto->field as  $field)
			{
				$attrs = $field->attributes();
				if($attrs->name=="data")
				{
					$mypacket->data = HexStringToBytes(strval($attrs->value), strlen($attrs->value));
					
				}
			}
		}
	
	}
	$mypacket->genKey();
	if(!isset($connections[$mypacket->key]))
	{
		$connections[$mypacket->key] = new MyConnection();
	}

	array_push($connections[$mypacket->key]->packetlist,$mypacket);
	
}

foreach($connections as $k=>$v)
{
	
	
	//echo "packet number : ". count($v->packetlist) . "\n";
// 	for($i=0;$i<count($v->packetlist);$i++)
// 	{
// 		$v->packetlist[$i]->dump();
// 	}
	//if(strpos($v->packetlist[0]->key, "53777"))
		$v->analize();
}

 类似资料：

相关阅读

PHP-解析txt文件php类中的各种拦截器用法分析php静态文件生成类实例分析php文件缓存类用法实例分析以编程方式分析jar文件

相关文章

PHP 包含分析第一个C语言程序文件分配表InnoDB的磁盘结构之日志文件格式分析传音 失效分析工程师

相关问答

分级多应用程序WAR生成文件拆分为单独包含的文件-“def”中断它以编程方式使用Soot分析.java源文件当我尝试解析XML文件时，如何防止文件被截断谷歌分析文件未找到React Native：包分析错误

相关文档

R 统计分析语言 中文教程Python 和 Pandas 数据分析教程及策实时分析平台帮助文档Tendermint 源码分析Memcached 源码分析
快捷导航： 新手教程 算法原理 架构设计 Java进阶 数据库进阶 大厂专栏 面试经验 编程笔记 编程问答 所有专题 文档资料 工具软件 电子书籍 小牛导航
在线工具： 房贷计算器 个税计算器 Linux命令查询 Json格式化 正则表达式 颜色转换 AES加解密 SHA1加密 MD5加密 毒鸡汤 字数统计 随机密码生成 进制转换 Base64编解码 励志句子
Copyright © 2019-2024 小牛知识库@xnip.cn. All Rights Reserved.