blocks|key|2025719|text|注意:在下面的信息中，假设GET还包括POST和其他HTTP方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2025720|这肯定要比查看一个数据包多得多的工作，但如果您捕获整个流，您应该能够从发出的HTTP标头中获取它。|2025721|尝试查看Host标头(如果已提供)，以及GET实际请求的内容。GET可以是完整的URL，也可以只是服务器上的一个文件名。|2025722|还要注意，这与从IP地址获取域名无关。如果你想要域名，你必须挖掘数据。|2025723|在我的机器上，Wireshark提供了一个简单的例子：|2025724|GET+http://www.google.ca+HTTP/1.1
Host:+www.google.ca
{other+headers+follow}|code-block|syntax|javascript|2025725|另一个例子，不是来自浏览器，GET中只有一个路径：|2025726|GET+/ccnet/XmlStatusReport.aspx+HTTP/1.1
Host:+example.com|2025727|在第二个示例中，实际的URL是http://example.com/ccnet/XmlStatusReport.aspx|offset|length|2025728|entityMap|0|LINK|mutability|MUTABLE|url|http://example.com/ccnet/XmlStatusReport.aspx^0|0|0|0|0|0|0|0|0|F|19|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|15|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|16|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|17|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|18|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|19|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|A|$]]|$1|Q|3|R|5|L|7|1B|8|@]|9|@]|A|$M|N]]|$1|S|3|T|5|6|7|1C|8|@]|9|@$U|1D|V|1E|1|1F]]|A|$]]|$1|W|3|-4|5|6|7|1G|8|@]|9|@]|A|$]]]|X|$Y|$5|Z|10|11|A|$12|13]]]]

Note: In the info below, assume that GET also includes POST and the other HTTP methods too.

It's definitely going to be a lot more work than looking at one packet, but if you capture the entire stream you should be able to get it from the HTTP headers sent out.

Try looking at the Host header if that's provided, and also what is actually requested by the GET. The GET can be either a full URL or just a file name on the server.

Also note that this has nothing to do with getting a domain name from an IP address. If you want the domain name, you have to dig into the data.

Quick example on my machine, from Wireshark:

<pre><code>GET http://www.google.ca HTTP/1.1
Host: www.google.ca
{other headers follow}
</code></pre>

Another example, not from a browser, and with only a path in the GET:

<pre><code>GET /ccnet/XmlStatusReport.aspx HTTP/1.1
Host: example.com
</code></pre>

In the second example, the actual URL is <a href="http://example.com/ccnet/XmlStatusReport.aspx" rel="nofollow noreferrer">http://example.com/ccnet/XmlStatusReport.aspx</a>

blocks|key|721701|text|不，没有足够的信息。单个IP可以对应于任意数量的域名，并且这些域名中的每一个都可以具有无限数量的URL。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|721702|但是，看看gethostbyaddr(3)，看看如何在ip上执行反向dns查找，以便至少获得该ip的规范名称。|721703|更新:由于您已经编辑了问题，@aehiilrs有一个much+better+answer。|offset|length|721704|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/2073183/writing-a-http-sniffer/2073405#2073405^0|0|0|Q|H|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@$F|S|G|T|1|U]]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

No, there is not enough information. A single IP can correspond to any number of domain names, and each of those domains could have literally an infinite number of URLs.

However, look at gethostbyaddr(3) to see how to do a reverse dns lookup on the ip to at least get the canonical name for that ip.

Update: as you've edited the question, @aehiilrs has a <a href="https://stackoverflow.com/questions/2073183/writing-a-http-sniffer/2073405#2073405">much better answe</a>r.

blocks|key|911760|text|您可能需要反向DNS查找。为此调用gethostbyaddr。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|911761|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

What you might want is a reverse DNS lookup. Call gethostbyaddr for that.

blocks|key|2022664|text|如果您使用的是Linux，您可以在iptables中添加一个筛选器，以添加一个新规则来查找包含HTTP+get请求的数据包并获取url。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2022665|因此，规则将如下所示。|2022666|对于从本地主机->通过端口80的每个数据包，检查数据包是否包含GET请求->，检索url并保存它|2022667|这种方法应该在所有情况下都有效，甚至对HTTPS报头也是如此。|2022668|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

If you are using Linux, you can add a filter in iptables to add a new rule which looks for packets containing HTTP get requests and get the url. 

So rule will look like this.

For each packet going on port 80 from localhost -> check if the packet contains GET request -> retrieve the url and save it

This approach should work in all cases, even for HTTPS headers.

blocks|key|2320348|text|看看PasTmon吧。http://pastmon.sourceforge.net|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2320349|entityMap|0|LINK|mutability|MUTABLE|url|http://pastmon.sourceforge.net/^0|B|U|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Have a look at PasTmon. <a href="http://pastmon.sourceforge.net" rel="nofollow noreferrer">http://pastmon.sourceforge.net</a>

blocks|key|911920|text|我正在研究类似的东西，偶然发现了这一点。如果你正在使用linux+-+justniffer，希望这是一个很好的开始。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|911921|http://justniffer.sourceforge.net/|offset|length|911922|还有一个很好的http流量抓取python脚本，如果你想从HTTP请求中获取信息，它会有所帮助。|911923|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|Y|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

I was researching on something similar and came across this.
Hope this could be a good start if you are using linux - justniffer.

<a href="http://justniffer.sourceforge.net/" rel="nofollow">http://justniffer.sourceforge.net/</a>

There is also a nice http traffic grab python script that would help if you are looking to get information from HTTP requests.

I would like to write a program to extract the URLs of websites visited by a system (an IP address) through packet capture.. I think this URL will come in the data section ( ie not in any of the headers - ethernet / ip / tcp-udp ).. ( Such programs are sometimes referred to as http sniffers , i'm not supposed to use any available tool ). As a beginner , I've just now gone through this basic sniffer program : <a href="http://www.tcpdump.org/sniffex.c" rel="nofollow noreferrer">sniffex.c</a>.. Can anyone please tell me in which direction i should proceed..

writing a http sniffer

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我想写一个程序，通过数据包捕获来提取系统访问的网站的URL( IP地址)。我认为这个URL会出现在数据部分(即不在任何报头中-以太网/ ip / tcp-udp )..(这样的程序有时被称为http嗅探器，我不应该使用任何可用的工具)。作为一个初学者，我刚刚经历了一个基本的嗅探器程序：。有人能告诉我我应该往哪个方向走吗？

问编写http嗅探器
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问编写http嗅探器EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问编写http嗅探器
EN