检测当前网卡是否处于混杂模式 - Flier????s Sky - 博客园

我不是女神ヾ 2022-08-23 15:49 256阅读 0赞

导读：

**检测当前网卡是否处于混杂模式  
  
[http://www.blogcn.com/user8/flier\_lu/index.html?id=1245590&run=.0C9B086][http_www.blogcn.com_user8_flier_lu_index.html_id_1245590_run_.0C9B086]**  
  
 今天比较巧，刚刚把重起网卡的文章贴上来，就有同事要我写个检测网卡混杂模式的小工具。本以为 [WinPCap][]会提供此功能，但翻了一遍Packet32.c和其驱动代码后，发现居然没有提供接口。只好下班、跑步、吃饭，然后老老实实google找解决方法，呵呵  
实际上方法很简单，打开一个网卡设备，查询其全局统计信息（IOCTL\_NDIS\_QUERY\_GLOBAL\_STATS），然后判断相应的标志位（NDIS\_PACKET\_TYPE\_PROMISCUOUS）是否设置，即可判断此网卡是否进入混杂模式。  
首先还是枚举网卡ID，我这儿偷懒直接用WinPCap提供的PacketGetAdapterNames函数，获取网卡列表。WinPCap 3.x返回的适配器设备名是类似DeviceNPF\_\{4BA2EE23-C4FE-488E-98CD-FE129206458A\}这种格式的，因此要字符串操作去掉DeviceNPF\_前缀，组装成/.\{4BA2EE23-C4FE-488E-98CD-FE129206458A\}这种形式的设备名，用CreateFile打开。

> 
> 
> 
> 
> 
> 
> <table> 
> <tbody> 
> <tr> 
> <td>以下为引用： 
> <blockquote> 
> &nbsp;string::size_type&nbsp;idx&nbsp;=&nbsp;name.find_last_of('{'); 
> 
> 
> 
> &nbsp;if(idx&nbsp;==&nbsp;string::npos) &nbsp;&nbsp;&nbsp;return; 
> 
> &nbsp;string&nbsp;strDev&nbsp;=&nbsp;"//./"&nbsp;+&nbsp;name.substr(idx); 
> 
> &nbsp;HANDLE&nbsp;hNic&nbsp;=&nbsp;CreateFile(strDev.c_str(),&nbsp;0,&nbsp;FILE_SHARE_READ,&nbsp;NULL,&nbsp;OPEN_EXISTING,&nbsp;0,&nbsp;INVALID_HANDLE_VALUE); &nbsp; 
> </blockquote></td> 
> </tr> 
> </tbody> 
> </table>

如果打开设备成功，则可以使用DeviceIoControl函数向其发送获取全局统计信息的请求，其实这儿叫网卡设备配置信息更合适 :)

> 
> 
> 
> 
> 
> 
> <table> 
> <tbody> 
> <tr> 
> <td>以下为引用： 
> <blockquote> 
> &nbsp;DWORD&nbsp;dwInBuf&nbsp;=&nbsp;OID_GEN_CURRENT_PACKET_FILTER,&nbsp;dwOutBuf&nbsp;=&nbsp;0,&nbsp;dwByteReturn&nbsp;=&nbsp;0; 
> 
> 
> 
> &nbsp;if(DeviceIoControl(hNic,&nbsp;IOCTL_NDIS_QUERY_GLOBAL_STATS,&nbsp; &nbsp;&nbsp;&nbsp;&amp;dwInBuf,&nbsp;sizeof(dwInBuf),&nbsp;&amp;dwOutBuf,&nbsp;sizeof(dwOutBuf),&nbsp;&amp;dwByteReturn,&nbsp;NULL)) &nbsp;{ &nbsp;&nbsp;&nbsp;cout&nbsp;&lt;&lt;&nbsp;endl&nbsp;&lt;&lt;&nbsp;"&nbsp;mode="; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;static&nbsp;const&nbsp;char&nbsp;*NdisFilterTypes[]&nbsp;=&nbsp; &nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Directed",&nbsp;"Multicast",&nbsp;"All&nbsp;Multicast",&nbsp;"Broadcast",&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Source&nbsp;Routing",&nbsp;"Promiscuous",&nbsp;"SMT",&nbsp;"All&nbsp;Local", &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Group",&nbsp;"All&nbsp;Functional",&nbsp;"Functional",&nbsp;"MAC&nbsp;Frame" &nbsp;&nbsp;&nbsp;}; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;for(int&nbsp;i=0;&nbsp;i&lt;(sizeof(NdisFilterTypes)&nbsp;/&nbsp;sizeof(NdisFilterTypes[0]));&nbsp;i++) &nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if((dwOutBuf&nbsp;&amp;&nbsp;(1&nbsp;&lt;&lt;&nbsp;i))&nbsp;!=&nbsp;0) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout&nbsp;&lt;&lt;&nbsp;NdisFilterTypes[i]&nbsp;&lt;&lt;&nbsp;"&nbsp;"; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;} &nbsp; 
> </blockquote></td> 
> </tr> 
> </tbody> 
> </table>

网卡当前模式有多个标志位，由DDK的ntddndis.h文件指定标志位意义

> 
> 
> 
> 
> 
> 
> <table> 
> <tbody> 
> <tr> 
> <td>以下为引用： 
> <blockquote> 
> &nbsp;// 
> &nbsp;//&nbsp;Ndis&nbsp;Packet&nbsp;Filter&nbsp;Bits&nbsp;(OID_GEN_CURRENT_PACKET_FILTER). 
> &nbsp;// 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_DIRECTED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0x0001 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_MULTICAST&nbsp;&nbsp;&nbsp;&nbsp;0x0002 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_ALL_MULTICAST&nbsp;&nbsp;0x0004 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_BROADCAST&nbsp;&nbsp;&nbsp;&nbsp;0x0008 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_SOURCE_ROUTING&nbsp;&nbsp;0x0010 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_PROMISCUOUS&nbsp;&nbsp;&nbsp;0x0020 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_SMT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0x0040 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_ALL_LOCAL&nbsp;&nbsp;&nbsp;&nbsp;0x0080 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_MAC_FRAME&nbsp;&nbsp;&nbsp;&nbsp;0x8000 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_FUNCTIONAL&nbsp;&nbsp;&nbsp;&nbsp;0x4000 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_ALL_FUNCTIONAL&nbsp;&nbsp;0x2000 
> &nbsp;#define&nbsp;NDIS_PACKET_TYPE_GROUP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0x1000 
> &nbsp; 
> </blockquote></td> 
> </tr> 
> </tbody> 
> </table>

有兴趣仔细看看的朋友可以参考这个讨论 [Detecting if Adapter is in Promiscuous mode][]。有一个小工具也完成了类似的功能 [PromiscDetect][]，可惜不开源，不然我也不用折腾了，呵呵  
此外PCAUSA提供的两个小工具和例子也很不错，对了解NDIS很有帮助

[PCAUSA NDIS Developer Tools][]  
[MACADDR II IOCTL\_NDIS\_QUERY\_GLOBAL\_STATS Sample Application][MACADDR II IOCTL_NDIS_QUERY_GLOBAL_STATS Sample Application]

本文转自  
[http://www.cnblogs.com/flier/archive/2004/07/08/22301.html][http_www.cnblogs.com_flier_archive_2004_07_08_22301.html]

[http_www.blogcn.com_user8_flier_lu_index.html_id_1245590_run_.0C9B086]: http://www.blogcn.com/user8/flier_lu/index.html?id=1245590&run=.0C9B086
[WinPCap]: http://winpcap.polito.it/
[Detecting if Adapter is in Promiscuous mode]: http://groups.google.com/groups?hl=zh-CN&lr=&ie=UTF-8&inlang=zh-CN&threadm=770096f8.0205122032.6ce73abc%40posting.google.com&rnum=7&prev=/groups%3Fq%3Dquery%2BNDIS_PACKET_TYPE_PROMISCUOUS%26hl%3Dzh-CN%26lr%3D%26ie%3DUTF-8%26inlang%3Dzh-CN%26selm%3D770096f8.0205122032.6ce73abc%2540posting.google.com%26rnum%3D7
[PromiscDetect]: http://www.ntsecurity.nu/toolbox/promiscdetect/
[PCAUSA NDIS Developer Tools]: http://www.pcausa.com/Utilities/ndistools.htm
[MACADDR II IOCTL_NDIS_QUERY_GLOBAL_STATS Sample Application]: http://www.pcausa.com/Utilities/macaddr2.htm
[http_www.cnblogs.com_flier_archive_2004_07_08_22301.html]: http://www.cnblogs.com/flier/archive/2004/07/08/22301.html