C/C++网络编程时注意的问题小结

1.网络编程在自己定义结构体实现协议的时候，一定要注意字节对齐这个问题。否则sizeof和强制转换指针的时候都会出现很难发现的bug。

什么是字节对齐自行百度。

 #pragma pack (1)//字节对齐的控制！非常注意！
 //定义一个以太网头部
 typedef struct ehhdr

 {

     UCHAR    eh_dst[];        /* destination ethernet addrress */

     UCHAR    eh_src[];        /* source ethernet addresss */

     USHORT   eh_type;          /* ethernet pachet type    */

 }ETHERHEAD;

 //28字节的ARP请求/应答

 typedef struct arphdr

 {

     USHORT    arp_hrd;            /* format of hardware address */

     USHORT    arp_pro;            /* format of protocol address */

     UCHAR     arp_hln;            /* length of hardware address */

     UCHAR     arp_pln;            /* length of protocol address */

     USHORT    arp_op;             /* ARP/RARP operation */

     UCHAR     arp_sha[];         /* sender hardware address */

     ULONG     arp_spa;            /* sender protocol address */

     UCHAR     arp_tha[];         /* target hardware address */

     ULONG     arp_tpa;            /* target protocol address */

 }ARPHEAD;

 #pragma pack ()//字节对齐的控制

2. 注意网络字节序和本机字节序的转换。使用ntohs()等函数。下面是一个winpcap回调函数的例子，用来检测本机是否在进行ARP扫描，对代码有任何建议欢迎指出交流。

 void packet_handler_ARP(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
 {
     struct tm *ltime;
     ltime = new struct tm;
     char timestr[];
     time_t local_tv_sec;
     time_t tTimer = time();
     static unsigned short nNum;

     if ( tTimer - g_tStartTimer > SNIFF_TIME)//计时嗅探时间
          pcap_breakloop(g_OpenDev);

     /* 将时间戳转换成可识别的格式 */
     local_tv_sec = header->ts.tv_sec;
     localtime_s(ltime, &local_tv_sec);
     strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);

     printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);

     //嗅探自己是否发出了ARP
     ETHERHEAD *pEtherHead = NULL;
     pEtherHead = (ETHERHEAD*)pkt_data;
     if ( strncmp((const char*)(pEtherHead->eh_src), (const char*)(g_aMac), ) == ) {//检测源地址是否是本机
         ARPHEAD *pARPHead = NULL;
         //printf ("是本机发出的ARP数据");
         pARPHead = (ARPHEAD*)(pkt_data + sizeof(ETHERHEAD));
         if (ntohs (pARPHead->arp_pro) == 0x0800 &&//IP
             ntohs(pARPHead->arp_op) == 0x0001 &&//ARP Request
             (ntohl(pARPHead->arp_tpa) & 0xffff0000)== 0xc0a80000 ) {//是ARP请求内网IP
                 nNum ++;
                 //printf ("计数+1\n");
                 if (nNum > WARN_NUM) {//计数超过了阈值参数
                     g_bWarning = true;
                     pcap_breakloop(g_OpenDev);
                 }
         }
     }

 }