如何从TCP数据包中获取有效载荷?

Question

我想使用pcapplusplus库或其他类似的库从tcp数据包中提取tcp有效负载数据。我搜索文档，但无法找到如何获得tcp有效载荷，但我可以通过使用各种api在tcp头中获得几乎任何东西。我怎样才能得到有效载荷?

Public Member Functions
TcpLayer (uint8_t *data, size_t dataLen, Layer *prevLayer, Packet *packet)

TcpLayer ()

TcpLayer (uint16_t portSrc, uint16_t portDst)

TcpLayer (const TcpLayer &other)

TcpLayer &  operator= (const TcpLayer &other)

tcphdr *    getTcpHeader () const

uint16_t    getSrcPort () const

uint16_t    getDstPort () const

TcpOption   getTcpOption (TcpOptionType option) const

TcpOption   getFirstTcpOption () const

TcpOption   getNextTcpOption (TcpOption &tcpOption) const

size_t  getTcpOptionCount () const

TcpOption   addTcpOption (const TcpOptionBuilder &optionBuilder)

TcpOption   addTcpOptionAfter (const TcpOptionBuilder &optionBuilder, TcpOptionType prevOptionType=TCPOPT_Unknown)

bool    removeTcpOption (TcpOptionType optionType)

bool    removeAllTcpOptions ()

uint16_t    calculateChecksum (bool writeResultToPacket)

void    parseNextLayer ()

size_t  getHeaderLen () const

void    computeCalculateFields ()

std::string     toString () const

OsiModelLayer   getOsiModelLayer () const

这些是获取tcp头数据的API。

Answer 1

为了获得(任何)层有效载荷，您应该使用getLayerPayload()API，例如:

pcpp::TcpLayer* tcpLayer = myPacket.getLayerOfType<pcpp::TcpLayer>();
uint8_t* payload = tcpLayer->getLayerPayload();
size_t payloadSize = tcpLayer->getLayerPayloadSize();

Answer 2

经过广泛的搜索，我得到了答案。是TcpStreamData::getData()法。你可以看到API文档的链接。