C# 实现抓包的实例代码

// 获取连接列表
CaptureDeviceList devices = CaptureDeviceList.Instance;

// 无连接
if (devices.Count < 1)
{
  Console.WriteLine("No devices were found on this machine");
  return;
}

Console.WriteLine("\n以下为本机连接：");
Console.WriteLine("--------------\n");

int j=0;
string temp = "";
Regex r = new Regex("FriendlyName: .*\n"); //匹配连接的FriendlyName
Match m;
// 打印连接设备
foreach (ICaptureDevice dev in devices)
{
  temp = dev.ToString();
  m = r.Match(temp);
  Console.WriteLine("{0}：{1}\n", j++, m.ToString());
}
Console.Write("输入设备号");
string input = Console.ReadLine();
int i = 0;
try
{
  i = Int32.Parse(input);
}
catch (Exception e)
{
  Console.WriteLine("非法输入！"+e.Message);
  return;
}
if (devices.Count < 1 || i == -1)
{
  Console.WriteLine("变量非法！");
  return;
}
// 得到指定连接设备
ICaptureDevice device = devices[i];

// 定义“包到达”事件
device.OnPacketArrival +=new SharpPcap.PacketArrivalEventHandler(device_OnPacketArrival);

// 打开连接
int readTimeoutMilliseconds = 1000;
device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds);

// 设置仅获取目标端口为1234的tcp包
string filter = "tcp dst port 1234";
device.Filter = filter;

// 开始无限期捕获包
device.Capture();

private static void device_OnPacketArrival(object sender, CaptureEventArgs e)
{
  //获取以太网（Ethernet）的帧
  var ent = PacketDotNet.EthernetPacket.ParsePacket(LinkLayers.Ethernet, e.Packet.Data);
  //获取ip包
  var ip = ent.PayloadPacket;
  //获取tcp包
  var tcp = ip.PayloadPacket;
  //格式化tcp包，可直接读取tcp包中的相应值
  var tcp_packet = new TcpPacket(new ByteArraySegment(tcp.Bytes));
  if (tcp != null)
  {
    DateTime time = e.Packet.Timeval.Date;
    if (tcp.PayloadData != null)
    {
      //根据需要，获取tcp的data数据
      string str = BitConverter.ToString(tcp.PayloadData);
      /*
      *
      其他数据处理
      *
      */
    }
  }
}