WinPcap/libpcap网络抓包分析TCP头标志位
最近使用WinPcap/libpcap抓取网络数据包，从而提取HTML和图片。分析到TCP包的时候被字节序搞的脑袋大了。最后耐着性子把标志位字段分别读取出来。
TCP头部结构体声明：
//structure of TCP headerstruct tcp_hdr {u_shortsport;//source portu_short dport;//destinate portu_int32_t sn;//SNu_int32_t an;//ANu_int16_t other;//header length(4 bit) + //reserved(6 bit) + //URG + ACK + PSH + RST + SYN + FINu_int16_t win_size;//window sizeu_int16_t checksum;//Checksumu_int16_t urg_ptr;//urgent pointeru_int32_t option;//32-bit};/** * Get URG bit * */int tcp_bit_urg(struct tcp_hdr *th) {return (th->other & 0x2000) == 0 ? 0 : 1;}/** * Get ACK bit * */int tcp_bit_ack(struct tcp_hdr *th) {return (th->other & 0x1000) == 0 ? 0 : 1;}/** * Get PSH bit * */int tcp_bit_psh(struct tcp_hdr *th) {return (th->other & 0x0800) == 0 ? 0 : 1;}/** * Get RST bit * */int tcp_bit_rst(struct tcp_hdr *th) {return (th->other & 0x0400) == 0 ? 0 : 1;}/** * Get SYN bit * */int tcp_bit_syn(struct tcp_hdr *th) {return (th->other & 0x0200) == 0 ? 0 : 1;}/** * Get FIN bit * */int tcp_bit_fin(struct tcp_hdr *th) {return (th->other & 0x0100) == 0 ? 0 : 1;}/** * Get tcp header length * */int tcp_header_len(struct tcp_hdr *th) {return ((th->other >> 4) & 0xf) * 4;}