当前位置: 代码迷 >> Wireless >> []DHCP 抓包 、报文格式、分析
  详细解决方案

[]DHCP 抓包 、报文格式、分析

热度:3632   发布时间:2013-02-26 00:00:00.0
[求助]DHCP 抓包 、报文格式、分析
我用VB写了简短几句:
Dim i
Private Sub Form_Load()
w.Protocol = sckUDPProtocol
w.Bind 67
End Sub
Private Sub w_DataArrival(ByVal bytesTotal As Long)
Me.Caption = bytesTotal
Open "c:\t" & i & ".txt" For Binary As #1
Dim b
w.GetData b
Put #1, , b
Close #1
i = i + 1
End Sub



然后我拔插网线后收到4个回复,下面是第一个,应该是DHCP discover 包:
Offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

00000000 11 20 01 00 2C 01 00 00 00 00 00 00 01 01 06 00 . ..,...........
00000016 B1 05 66 6C 00 00 00 00 00 00 00 00 00 00 00 00 ?fl............
00000032 00 00 00 00 00 00 00 00 00 1A 73 4F A1 59 00 00 ..........sO?..
00000048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000064 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000096 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000112 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000144 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000176 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000192 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000208 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000224 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000240 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 74 ........c係c5..t
00000256 01 01 3D 07 01 00 1A 73 4F A1 59 0C 0F 63 68 69 ..=....sO?..chi
00000272 6E 61 2D 61 32 32 38 39 31 38 66 62 3C 08 4D 53 na-a228918fb<.MS
00000288 46 54 20 35 2E 30 37 0B 01 0F 03 06 2C 2E 2F 1F FT 5.07.....,./.
00000304 21 F9 2B 2B 02 DC 00 FF !?+.??



我再把端口改成68,下面是收到的第一个包:
Offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

00000000 11 20 01 00 22 01 00 00 00 00 00 00 02 01 06 00 . .."...........
00000016 5E CE 51 F2 00 00 00 00 00 00 00 00 C0 A8 6F 45 ^蜵?.......括oE
00000032 C0 A8 6F 6F 00 00 00 00 00 1A 73 4F A1 59 00 00 括oo......sO?..
00000048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000064 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000096 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000112 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000144 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000176 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000192 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000208 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000224 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000240 00 00 00 00 00 00 00 00 63 82 53 63 35 01 02 01 ........c係c5...
00000256 04 FF FF FF 00 3A 04 00 00 A8 C0 3B 04 00 01 27 .???.:...ɡ;...'
00000272 50 33 04 00 01 51 80 36 04 C0 A8 6F 6F 03 04 C0 P3...Q?6.括oo..?
00000288 A8 6F 6F 06 08 77 06 06 06 CA 6A 00 14 FF ╫o..w...蔶..?

问题:
1。 数据开始00000000 11 20 01 00 2C 01 00 00 00 00 00 00 代表的是什么?我写程序怎么去组这些数据?(怎么在DHCP协议里面没看见)
2。 第一个数据包结尾处63 82 53 63 带表的是什么?我写程序怎么去组这些数据?
3。 接着问题2后面35 01 01 代表的是DHCP Discover,帮我详细分析一下后面的内容。如果我自己写客户端,后面那些是必须的?
4。 第二个包的内容我已经知道是网卡参数方面的了。重点解释前3个问题吧。

------解决方案--------------------------------------------------------
如果你不懂协议,就得依靠工具。
看文档积短时间不会有正确的认识。
用wireshark 工具,你会有意想不到的收获
  相关解决方案