1 import java.io.BufferedReader;
 2 import java.io.FileNotFoundException;
 3 import java.io.FileReader;
 4 import java.io.IOException;
 5 import java.util.ArrayList;
 6 import jpcap.JpcapCaptor;
 7 import jpcap.JpcapWriter;
 8 import jpcap.packet.IPPacket;
 9 import jpcap.packet.Packet;
10
11 public class Handler {
12
13     static JpcapCaptor captor;
14     static JpcapWriter writer;
15
16     static final String KEYWORD = "GTunnel.exe"; // 查找关键字
17
18     static final String OUTPUT_PCAP_FILE_NAME = "fresh.pcap"; // 保存GTunnel纯数据流的文件名
19
20     public static void main(String[] args) {
21
22         if(args.length < 2) {
23             System.out.println("Invalid argument Error: java Handler [gtfilename] [pcapfilename] ([outputpcapfilename])");
24             return;
25         }
26
27         // 解析gt.exe生成的文件，得到GTunnel相关行信息，主要是获得目标主机的IP地址作为匹配地址
28         BufferedReader br = null;
29         try {
30             br = new BufferedReader(new FileReader(args[0]));
31         } catch (FileNotFoundException e1) {
32             // TODO Auto-generated catch block
33             e1.printStackTrace();
34         }
35
36         String line = null;
37         ArrayList<String> list = new ArrayList<String>();
38
39         try {
40             while ((line = br.readLine()) != null) {
41                 if (line.contains(KEYWORD)) { // 匹配含有GTunnel.exe关键字
42                     String remoteIP = line.split(",")[1].trim();
43                     if (!list.contains(remoteIP))
44                         list.add(remoteIP);
45                 }
46             }
47         } catch (IOException e) {
48             e.printStackTrace();
49         } finally {
50             try {
51                 if (br != null) {
52                     br.close();
53                     br = null;
54                 }
55             } catch (IOException e) {
56                 e.printStackTrace();
57             }
58         }
59
60         // 解析pcap文件
61         try {
62             captor = JpcapCaptor.openFile(args[1]);
63             writer = JpcapWriter.openDumpFile(captor, args.length >= 3 ? args[2] : OUTPUT_PCAP_FILE_NAME);
64         } catch (IOException e) {
65             // TODO Auto-generated catch block
66             e.printStackTrace();
67         }
68         while (true) {
69             // read a packet from the opened file
70             Packet packet = captor.getPacket();
71             // if some error occurred or EOF has reached, break the loop
72             if (packet == null || packet == Packet.EOF)
73                 break;
74             // otherwise
75             if(packet instanceof IPPacket) {
76                 IPPacket ipPacket = (IPPacket) packet;
77                 // 从pcap文件中解析出所有与匹配地址一致的源/目的地址所对应的数据流
78                 if(list.contains(ipPacket.src_ip.getHostAddress()) || list.contains(ipPacket.dst_ip.getHostAddress())) {
79                     // 将数据流存入文件
80                     writer.writePacket(packet);
81                 }
82             }
83         }
84
85         writer.close();
86         captor.close();
87
88     }
89
90 }