寻求iOS平台监控DHCP、m-DNS、DNS流量的入门代码及解决方案

Hey there! Since you're coming from general dev experience and just dipping your toes into iOS development + Network Extensions, let's walk through practical, beginner-friendly code and alternative approaches to meet your traffic monitoring goals—focused on DHCP broadcasts, m-DNS, and DNS traffic.

Network Extensions are Apple's official way to deep-dive into iOS network traffic. For your needs, a Content Filter Extension will let you capture, identify, and log the specific packet types you care about.

1.1 Project Setup First #

• In Xcode, create a new iOS App project, then add a Network Extension target (choose Content Filter from the template).
• Enable the Network Extensions capability for both your main app and the extension target.
• Make sure you have an active Apple Developer account (you'll need it to test on real devices—simulators don't support most Network Extension features).

1.2 Starter Code for Traffic Monitoring #

Here's a simplified implementation to detect and log DHCP, m-DNS, and DNS traffic:

Extension Code (Filter Provider) #

import NetworkExtension

class TrafficFilterProvider: NEFilterDataProvider {
    
    override func startFilter(completionHandler: @escaping (Error?) -> Void) {
        // Define rules to target our desired traffic types
        let filterRules = NEFilterRules(rules: [
            // DHCP (UDP ports 67/68)
            NEFilterRule(
                networkRule: NEFilterNetworkRule(
                    remoteAddress: "*",
                    remotePrefix: 0,
                    localAddress: "*",
                    localPrefix: 0,
                    protocol: .udp,
                    remotePortRange: NEFilterPortRange(from: 67, to: 68),
                    localPortRange: NEFilterPortRange(from: 67, to: 68),
                    direction: .both
                ),
                action: .allow,
                actionOrder: 1
            ),
            // m-DNS (UDP port 5353)
            NEFilterRule(
                networkRule: NEFilterNetworkRule(
                    remoteAddress: "*",
                    remotePrefix: 0,
                    localAddress: "*",
                    localPrefix: 0,
                    protocol: .udp,
                    remotePortRange: NEFilterPortRange(from: 5353, to: 5353),
                    localPortRange: NEFilterPortRange(from: 5353, to: 5353),
                    direction: .both
                ),
                action: .allow,
                actionOrder: 2
            ),
            // DNS (UDP/TCP port 53)
            NEFilterRule(
                networkRule: NEFilterNetworkRule(
                    remoteAddress: "*",
                    remotePrefix: 0,
                    localAddress: "*",
                    localPrefix: 0,
                    protocol: .udp,
                    remotePortRange: NEFilterPortRange(from: 53, to: 53),
                    localPortRange: NEFilterPortRange(from: 53, to: 53),
                    direction: .both
                ),
                action: .allow,
                actionOrder: 3
            ),
            NEFilterRule(
                networkRule: NEFilterNetworkRule(
                    remoteAddress: "*",
                    remotePrefix: 0,
                    localAddress: "*",
                    localPrefix: 0,
                    protocol: .tcp,
                    remotePortRange: NEFilterPortRange(from: 53, to: 53),
                    localPortRange: NEFilterPortRange(from: 53, to: 53),
                    direction: .both
                ),
                action: .allow,
                actionOrder: 4
            )
        ], defaultAction: .allow)
        
        self.filterRules = filterRules
        completionHandler(nil)
    }
    
    override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
        guard let socketFlow = flow as? NEFilterSocketFlow else {
            return .allow()
        }
        
        let remotePort = socketFlow.remoteEndpoint?.port ?? 0
        let localPort = socketFlow.localEndpoint?.port ?? 0
        let protocolType = socketFlow.protocol.rawValue
        
        // Identify traffic type
        var trafficType: String?
        if protocolType == IPPROTO_UDP && (remotePort.isIn(67...68) || localPort.isIn(67...68)) {
            trafficType = "DHCP"
        } else if protocolType == IPPROTO_UDP && (remotePort == 5353 || localPort == 5353) {
            trafficType = "m-DNS"
        } else if (protocolType == IPPROTO_UDP || protocolType == IPPROTO_TCP) && (remotePort == 53 || localPort == 53) {
            trafficType = "DNS"
        }
        
        if let type = trafficType {
            print("📡 Detected \(type) flow: \(socketFlow.localEndpoint ?? "unknown") → \(socketFlow.remoteEndpoint ?? "unknown")")
            
            // Optional: Capture and log packet payload
            socketFlow.readData { data, error in
                if let data = data {
                    print("📦 \(type) payload (hex): \(data.hexEncodedString())")
                    // You can add parsing logic here (e.g., decode DNS queries or DHCP offers)
                }
            }
        }
        
        return .allow()
    }
}

// Helper extensions for easier debugging
extension Data {
    func hexEncodedString() -> String {
        map { String(format: "%02hhx", $0) }.joined()
    }
}

extension Int {
    func isIn(_ range: ClosedRange<Int>) -> Bool {
        range.contains(self)
    }
}

Main App Code (Activate the Filter) #

import NetworkExtension
import UIKit

class ViewController: UIViewController {

    override func viewDidLoad() {
        super.viewDidLoad()
        setupTrafficFilter()
    }
    
    private func setupTrafficFilter() {
        NEFilterManager.shared.loadFromPreferences { error in
            if let error = error {
                print("Failed to load filter settings: \(error.localizedDescription)")
                return
            }
            
            let filterProvider = NEFilterProvider()
            filterProvider.serverAddress = "com.yourcompany.yourapp.TrafficFilter" // Replace with your extension's bundle ID
            NEFilterManager.shared.provider = filterProvider
            NEFilterManager.shared.isEnabled = true
            
            NEFilterManager.shared.saveToPreferences { error in
                if let error = error {
                    print("Failed to activate filter: \(error.localizedDescription)")
                } else {
                    print("Traffic filter activated successfully!")
                }
            }
        }
    }
}

If you don't need full packet capture, these lighter-weight methods might work for specific parts of your goal:

2.1 DNS Proxy Extension (Focused on DNS) #

For DNS-specific monitoring, a DNS Proxy Extension is more efficient than a full content filter. It lets you intercept and log all DNS queries directly:

import NetworkExtension

class DNSProxyProvider: NEDNSProxyProvider {
    
    override func startProxy(options: [String : Any]?, completionHandler: @escaping (Error?) -> Void) {
        let dnsSettings = NEDNSProxySettings()
        dnsSettings.matchDomains = ["*"] // Monitor all domains
        self.dnsSettings = dnsSettings
        completionHandler(nil)
    }
    
    override func handleDNSQuery(_ queryData: Data, completionHandler: @escaping (Data?) -> Void) {
        print("🔍 DNS query received: \(queryData.hexEncodedString())")
        // Forward the query to system DNS (or modify it if needed)
        completionHandler(queryData)
    }
}

Note: This won't capture m-DNS or DHCP traffic—stick with the content filter for those.

2.2 Bonjour Framework (m-DNS Service Discovery) #

If you only need to monitor m-DNS services (not raw packets), Apple's Bonjour framework lets you detect local network services without Network Extensions:

import Foundation

class MDNSMonitor: NSObject, NSNetServiceBrowserDelegate, NSNetServiceDelegate {
    private let browser = NSNetServiceBrowser()
    
    func startMonitoring() {
        browser.delegate = self
        // Search for HTTP services (replace with your target service type, e.g., "_ssh._tcp.")
        browser.searchForServices(ofType: "_http._tcp.", inDomain: "local.")
    }
    
    func netServiceBrowser(_ browser: NSNetServiceBrowser, didFind service: NSNetService, moreComing: Bool) {
        print("🔍 Found m-DNS service: \(service.name)")
        service.delegate = self
        service.resolve(withTimeout: 5)
    }
    
    func netService(_ sender: NSNetService, didResolveAddresses addresses: [Data]) {
        for addressData in addresses {
            var hostname = [CChar](repeating: 0, count: Int(NI_MAXHOST))
            let sockaddrPtr = addressData.withUnsafeBytes { $0.baseAddress?.assumingMemoryBound(to: sockaddr.self) }
            if getnameinfo(sockaddrPtr, socklen_t(addressData.count), &hostname, socklen_t(hostname.count), nil, 0, NI_NUMERICHOST) == 0 {
                let ip = String(cString: hostname)
                print("📍 Resolved \(sender.name) to IP: \(ip)")
            }
        }
    }
}

// Usage:
// let monitor = MDNSMonitor()
// monitor.startMonitoring()

2.3 Indirect DHCP Monitoring #

You can't capture raw DHCP packets without Network Extensions, but you can track DHCP-assigned IP addresses using NWPathMonitor:

import Network

class DHCPStatusMonitor {
    private let pathMonitor = NWPathMonitor()
    
    func startMonitoring() {
        pathMonitor.pathUpdateHandler = { path in
            guard path.status == .satisfied else { return }
            
            for interface in path.interfaces {
                if let ipv4 = interface.ipv4Addresses.first {
                    print("🌐 DHCP assigned IPv4: \(ipv4)")
                }
                if let ipv6 = interface.ipv6Addresses.first {
                    print("🌐 DHCP assigned IPv6: \(ipv6)")
                }
            }
        }
        let queue = DispatchQueue(label: "DHCPMonitorQueue")
        pathMonitor.start(queue: queue)
    }
}

• Test on real devices: Most Network Extension features don't work in simulators.
• Privacy compliance: Add NSNetworkUsageDescription to your Info.plist to explain why you need network access.
• Performance: Keep filter rules focused—avoid capturing unnecessary traffic to prevent battery drain.

内容的提问来源于stack exchange，提问作者cmp