{"id":13826610,"url":"https://github.com/chentingz/snifferui","last_synced_at":"2025-07-09T00:34:12.562Z","repository":{"id":216003507,"uuid":"100602782","full_name":"Chentingz/SnifferUI","owner":"Chentingz","description":"基于MFC和WinPcap库开发的网络抓包和协议分析软件","archived":false,"fork":false,"pushed_at":"2021-12-08T09:00:03.000Z","size":91370,"stargazers_count":121,"open_issues_count":4,"forks_count":51,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-08-05T09:15:31.247Z","etag":null,"topics":["packet-analyser","packet-analyzer","packet-capture","pcap","protocol-analyser","sniffer","winpcap"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Chentingz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-08-17T12:46:59.000Z","updated_at":"2024-07-24T00:55:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"f825364c-9204-4a6e-a2ef-0313ab1f9d8a","html_url":"https://github.com/Chentingz/SnifferUI","commit_stats":null,"previous_names":["chentingz/snifferui"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chentingz%2FSnifferUI","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chentingz%2FSnifferUI/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chentingz%2FSnifferUI/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chentingz%2FSnifferUI/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Chentingz","download_url":"https://codeload.github.com/Chentingz/SnifferUI/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225476383,"owners_count":17480215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["packet-analyser","packet-analyzer","packet-capture","pcap","protocol-analyser","sniffer","winpcap"],"created_at":"2024-08-04T09:01:41.095Z","updated_at":"2024-11-20T05:30:54.465Z","avatar_url":"https://github.com/Chentingz.png","language":"C","funding_links":[],"categories":["\u003ca id=\"7bf0f5839fb2827fdc1b93ae6ac7f53d\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"32739127f0c38d61b14448c66a797098\"\u003e\u003c/a\u003e嗅探\u0026\u0026Sniff"],"readme":"\u003cp\u003e\n  \u003cimg src=\"https://github.com/Chentingz/SnifferUI/blob/master/SnifferUI/res/SnifferUI.ico\" align=left border=0 /\u003e\n  \u003ch1\u003eSnifferUI\u003c/h1\u003e\n\u003c/p\u003e  \n\n[![Release](https://img.shields.io/github/v/release/chentingz/snifferui)](https://github.com/Chentingz/SnifferUI/releases)\n[![Downloads](https://img.shields.io/github/downloads/chentingz/snifferui/total?color=brightgreen)](https://github.com/Chentingz/SnifferUI)\n[![Stars](https://img.shields.io/github/stars/chentingz/snifferui?color=orange)](https://github.com/Chentingz/SnifferUI)\n[![Forks](https://img.shields.io/github/forks/chentingz/snifferui?color=orange)](https://github.com/Chentingz/SnifferUI)\n\n这是一款基于MFC和WinPcap库开发的网络抓包和协议分析软件，你可以用它来采集本机网络流量并在线分析协议，或者读取pcap文件进行离线协议分析，快[下载](https://github.com/Chentingz/SnifferUI/releases)试试吧。\n\n开发环境：Win7 + Visual Studio 2015  \n依赖：WinPcap 4.1.3  \n技术细节：\n\n- MFC搭建前端界面\n- WinPcap实现本地网络接口抓包及pcap文件存储\n- 利用STL的map容器实现内存中数据包管理\n- 基于Windows消息队列实现线程间通信（抓包线程通知窗口线程解析和打印数据包或通知结束抓包释放资源）\n- 从0到1自写了9种网络协议解析器\n\n## 目录\n- [功能](#功能)\n- [运行截图](#运行截图)\n  - [v2.0](#v20)\n  - [v1.0](#v10)\n- [更新说明](#更新说明)\n- [ToDoList](#todolist)\n- [Known Issues](#known-issues)\n- [参考资料](#参考资料)\n\n## 功能\n\n\n* 本地网络接口上数据包实时捕获与在线协议分析\n* 提供pcap文件存储\n* 支持pcap文件读取与离线协议分析\n* 提供显示过滤器，选择指定协议的数据包进行显示\n* 支持常见网络协议解析  \n\n  | 层次 | 协议 |\n  | ------------------ | -----|\n  | 应用层             | DNS / HTTP / DHCP |\n  | 传输层             | UDP / TCP |\n  | 网络层             | IPv4 / ICMP |\n  | 数据链路层         | Ethernet / ARP |\n  \n  \n  | ICMP报文类型 | ICMP报文类型值 | 支持解析 |\n  | ------------ | -------------- | -------- |\n  | 目的地不可达 | 3              | √        |\n  | 源端抑制     | 4              | √        |\n  | 重定向       | 5              | √        |\n  | 超时         | 11             | √        |\n  | Echo请求     | 8              | √        |\n  | Echo响应     | 0              | √        |\n  \n  \n  | DNS资源记录类型 | 作用                        | 支持解析 |\n  | --------------- | --------------------------- | -------- |\n  | A               | 根据域名查询IP地址          | √        |\n  | NS              | 指定一个DNS服务器解析该域名 | √        |\n  | CNAME           | 查询域名的别名              | √        |\n  | PTR             | 根据IP地址查询域名          | √        |\n  \n  \n  | DHCP报文选项   | DHCP报文选项代码 | 支持解析 |\n  | -------------- | ---------------- | -------- |\n  | 填充           | 0                | √        |\n  | 子网掩码       | 1                | √        |\n  | 网关地址       | 3                | √        |\n  | DNS服务器地址  | 6                | √        |\n  | 域名           | 12               | √        |\n  | 请求IP地址     | 50               | √        |\n  | IP地址租约时间 | 51               | √        |\n  | DHCP消息类型   | 53               | √        |\n  | DHCP服务器标识 | 54               | √        |\n  | 厂商标识       | 60               | √        |\n  | 客户端标识     | 61               | √        |\n  | 结束           | 255              | √        |\n  \n* 支持快捷键  \n  \n    | 快捷键 | 功能 |\n    | ------| -----|\n    | Ctrl + G | 光标定位到当前选中数据包 |\n    | Ctrl + O | 打开pcap文件 |\n    | Ctrl + W | 关闭pcap文件 |\n    | Ctrl + S | 另存为新的pcap文件 |\n    | Alt + F4 | 退出程序 |\n\n## 运行截图\n### v2.0\n\u003cp align=center\u003e\n  \u003cimg src=\"https://github.com/Chentingz/SnifferUI/blob/master/img/SnifferUI_v2.0_Snapshot_20190624.png\" width = 75% height = 75%/\u003e\n\u003c/p\u003e  \n\n### v1.0\n\u003cp align=center\u003e\n  \u003cimg src=\"https://github.com/Chentingz/SnifferUI/blob/v1.0/img/decode_dns.PNG\" width = 75% height = 75%/\u003e  \n\u003c/p\u003e  \n\n## 更新说明\n* 2021/4/11\n  * 修复【点击'清除'按钮，不恢复显示所有数据包问题】\n  * 修复【选择网卡与实际抓包网卡不一致问题】\n  * 修复【进行新一轮抓包时，状态栏仍显示上一轮数据包捕获数量的问题】\n  * 修复【在Win10上运行程序时报wpcap.dll出错问题】\n* 2021/4/10\n  * 新增【程序启动后自动创建tmp文件夹】\n    * tmp文件夹用于存放实时抓包生成的pcap缓存文件\n  * 修复【实时抓包时界面卡顿问题】\n    * 抓包线程由原来的实时发送改为延时发送WM_PKTCATCH消息\n* 2019/6/24  \n  - 完善【菜单栏】\n    - 新增”清理缓存文件“菜单项\n    - 新增”快捷键一览“菜单项\n  - 新增【工具栏】\n    - 原网卡列表、过滤器列表、按钮等移动至工具栏上\n    - 用图标代替按钮文本\n  - 完善【数据包列表控件】\n    - 调整各列初始宽度\n    - 允许拖拽列表的列\n  - 完善【状态栏】\n    - 调整各栏宽度\n    - 新增“已显示”数据包个数\n  - 完善【“关于”窗口  】\n* 2019/5/23  \n  * 代码重构\n    * 新增【PacketCatcher类、PacketDumper类、PacketPool类】，降低抓包与界面之间耦合\n    * PacketCatcher类：实现数据包捕获，底层使用winpcap库函数\n    * PacketDumper类：实现捕获数据包转储到文件，仅支持转储.pcap文件\n    * PacketPool类：实现数据包管理，底层使用stl关联容器map存储数据包\n  * 新增【菜单栏】\n  * 新增【状态栏】\n  * 删除【“暂停”按钮】\n  * 新增【快捷键】   \n* 2019/1/22\n  * 新增【Packet类】封装数据包，解决内存泄露问题\n  * 界面更换为Win7风格\n* 2019/1/14 \n  * 新增【显示过滤器】\n* 2017/2/15 - 2017/3/12\n  * 完成v1.0开发\n  * 实现数据包实时捕获和常见协议解析\n  \n## ToDoList  \n- [x] v2.0中DHCP,DNS,HTTP解析的实现  \n- [x] 根据协议名过滤数据包  \n- [x] 数据包保存为.pcap格式文件  \n- [x] 鼠标移开list控件，保持选中行高亮 \n- [x] 添加菜单栏  \n- [ ] 优化内存占用率（目前抓取数据包数量很大时，内存占用率高）\n- [x] 添加工具栏\n\n## Known Issues\n- [x] 过滤后原来位置的底色保持不变  \n- [ ] DNS协议无法正确解析回答、授权回答、附加信息区域  \n- [x] 数据包16进制字节流格式不对齐  \n- [x] 按下结束后再开始，界面卡死  \n- [x] 使用过滤器后，若线程仍在抓包，新抓到的的数据包没有过滤就打印\n- [ ] 读取大pcap文件时，内存占用率高甚至出现程序崩溃 [#2](https://github.com/Chentingz/SnifferUI/issues/2)\n\n## 参考资料\n* [一步一步开发sniffer（Winpcap+MFC）（一）工欲善其事，必先配环境——配置winpcap开发环境](https://blog.csdn.net/litingli/article/details/5950962)\n* [一步一步开发sniffer（Winpcap+MFC）（二）掀起你的盖头来，让我来画你的脸——用MFC开发GUI](https://blog.csdn.net/litingli/article/details/6098654)\n* [一步一步开发sniffer（Winpcap+MFC）（三）安得广厦千万间，先画蓝图再砌砖——搭建winpcap抓包框架](https://blog.csdn.net/litingli/article/details/7315699)\n* [一步一步开发sniffer（Winpcap+MFC）（四）要想从此过，留下协议头——各层网络协议头的实现](https://blog.csdn.net/litingli/article/details/7315789)\n* [一步一步开发sniffer（Winpcap+MFC）（五）莫道无人能识君，其实我懂你的心——解析数据包](https://blog.csdn.net/litingli/article/details/7315914)\n* [一步一步开发sniffer（Winpcap+MFC）（六）千呼万唤始出来，不抱琵琶也露面——将解析数据写到GUI上](https://blog.csdn.net/litingli/article/details/7316173)\n* [RFC792 ICMP](https://www.rfc-editor.org/rfc/rfc792.txt)\n* [RFC1257 ICMP Router Discovery Messages](https://www.rfc-editor.org/rfc/rfc1256.txt)\n* [RFC1035  DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION](https://www.rfc-editor.org/rfc/rfc1035.txt)\n* [RFC2132 DHCP Options and BOOTP Vendor Extensions](https://www.rfc-editor.org/rfc/rfc2132.txt)\n* [WinPcap 4.0.1中文技术文档](http://www.ferrisxu.com/WinPcap/html/index.html)\n* [1184893257/SimpleSniffer](https://github.com/1184893257/SimpleSniffer)\n* [（鸡啄米） VS2010/MFC编程入门教程之目录和总结](http://www.jizhuomi.com/software/257.html)  \n\n## Stargazers over time\n\n[![Stargazers over time](https://starchart.cc/Chentingz/SnifferUI.svg)](https://starchart.cc/Chentingz/SnifferUI)\n\n[回到顶部](#snifferui)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchentingz%2Fsnifferui","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchentingz%2Fsnifferui","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchentingz%2Fsnifferui/lists"}