J-HONEYPOT毕设：如何在Java Swing中加载.pcap文件并存入MySQL？

Great question—integrating PCAP parsing into your Java Swing-based IDS/monitoring system is a critical step for J-HONEYPOT. I’ve built similar packet analysis tools before, so let’s break this down into actionable, code-backed steps to get you sorted.

First, you’ll need a library to read and decode .pcap files. Two reliable options are:

• jNetPcap: A mature, widely-used library with straightforward packet header access.
• Pcap4J: A more modern, Java 8+ compatible alternative with better type safety.

For this example, I’ll use jNetPcap (note: it requires WinPcap/Libpcap installed on your system). Add this Maven dependency if you’re using a build tool:

<dependency>
    <groupId>org.jnetpcap</groupId>
    <artifactId>jnetpcap</artifactId>
    <version>1.4.1</version>
</dependency>

You’ll need a simple UI to let users pick .pcap files, track progress, and log status. Here’s a minimal implementation:

import javax.swing.*;
import java.awt.*;
import java.io.File;

public class PcapLoaderUI extends JFrame {
    private final JTextArea logArea = new JTextArea(10, 50);
    private final JProgressBar progressBar = new JProgressBar();

    public PcapLoaderUI() {
        setTitle("J-HONEYPOT PCAP Loader");
        setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
        setLayout(new BorderLayout());

        // File selection button
        JButton loadBtn = new JButton("Load PCAP File");
        loadBtn.addActionListener(e -> openPcapFile());

        // UI components
        JPanel topPanel = new JPanel();
        topPanel.add(loadBtn);
        topPanel.add(progressBar);

        add(topPanel, BorderLayout.NORTH);
        add(new JScrollPane(logArea), BorderLayout.CENTER);

        pack();
        setLocationRelativeTo(null);
    }

    private void openPcapFile() {
        JFileChooser fileChooser = new JFileChooser();
        fileChooser.setFileFilter(new FileNameExtensionFilter("PCAP Files", "pcap"));
        int result = fileChooser.showOpenDialog(this);

        if (result == JFileChooser.APPROVE_OPTION) {
            File pcapFile = fileChooser.getSelectedFile();
            // Use SwingWorker to avoid freezing the UI during parsing
            new PcapParsingWorker(pcapFile).execute();
        }
    }

    // Worker thread for parsing
    private class PcapParsingWorker extends SwingWorker<Void, String> {
        private final File pcapFile;

        public PcapParsingWorker(File pcapFile) {
            this.pcapFile = pcapFile;
        }

        @Override
        protected Void doInBackground() throws Exception {
            publish("Starting parsing of: " + pcapFile.getName());
            parsePcapAndSave(pcapFile.getAbsolutePath());
            publish("Parsing and database insertion complete!");
            return null;
        }

        @Override
        protected void process(java.util.List<String> chunks) {
            chunks.forEach(msg -> logArea.append(msg + "\n"));
        }
    }

    public static void main(String[] args) {
        SwingUtilities.invokeLater(() -> new PcapLoaderUI().setVisible(true));
    }
}

Add this method to your PcapLoaderUI class to decode packets and extract key fields (source/dest IP, ports, protocol, payload):

import org.jnetpcap.Pcap;
import org.jnetpcap.packet.PcapPacket;
import org.jnetpcap.packet.PcapPacketHandler;
import org.jnetpcap.protocol.network.Ip4;
import org.jnetpcap.protocol.tcpip.Tcp;
import org.jnetpcap.protocol.tcpip.Udp;

private void parsePcapAndSave(String pcapPath) throws Exception {
    StringBuilder errBuf = new StringBuilder();
    Pcap pcap = Pcap.openOffline(pcapPath, errBuf);

    if (pcap == null) {
        throw new RuntimeException("Failed to open PCAP: " + errBuf);
    }

    // Initialize protocol headers
    Ip4 ipHeader = new Ip4();
    Tcp tcpHeader = new Tcp();
    Udp udpHeader = new Udp();

    PcapPacketHandler<String> handler = (packet, user) -> {
        // Skip non-IP packets
        if (!packet.hasHeader(ipHeader)) return;

        String srcIp = org.jnetpcap.packet.format.FormatUtils.ip(ipHeader.source());
        String dstIp = org.jnetpcap.packet.format.FormatUtils.ip(ipHeader.destination());
        String protocol = ipHeader.getProtocolDescription();

        int srcPort = -1, dstPort = -1;
        if (packet.hasHeader(tcpHeader)) {
            srcPort = tcpHeader.source();
            dstPort = tcpHeader.destination();
        } else if (packet.hasHeader(udpHeader)) {
            srcPort = udpHeader.source();
            dstPort = udpHeader.destination();
        }

        // Extract packet payload as hex string
        String payload = org.jnetpcap.packet.format.FormatUtils.hexdump(packet.getByteArray(0, packet.size()));

        // Save to database
        try {
            saveToDatabase(srcIp, dstIp, protocol, srcPort, dstPort, payload);
        } catch (SQLException ex) {
            publish("Error saving packet: " + ex.getMessage());
        }
    };

    // Process all packets
    pcap.loop(Pcap.LOOP_INFINITE, handler, "Processing");
    pcap.close();
}

Create a method to save extracted packet data to your MySQL database. For better performance, use batch inserts for large PCAP files:

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.SQLException;

private void saveToDatabase(String srcIp, String dstIp, String protocol, int srcPort, int dstPort, String payload) throws SQLException {
    // Use a connection pool (like HikariCP) in production instead of DriverManager
    String dbUrl = "jdbc:mysql://localhost:3306/j_honeypot?useSSL=false&serverTimezone=UTC";
    String dbUser = "your_username";
    String dbPass = "your_password";

    try (Connection conn = DriverManager.getConnection(dbUrl, dbUser, dbPass)) {
        String sql = """
            INSERT INTO captured_packets 
            (src_ip, dst_ip, protocol, src_port, dst_port, payload, capture_time)
            VALUES (?, ?, ?, ?, ?, ?, NOW())
            """;

        try (PreparedStatement stmt = conn.prepareStatement(sql)) {
            stmt.setString(1, srcIp);
            stmt.setString(2, dstIp);
            stmt.setString(3, protocol);
            stmt.setInt(4, srcPort);
            stmt.setInt(5, dstPort);
            stmt.setString(6, payload);
            stmt.executeUpdate();
        }
    }
}

• Batch Inserts: For large PCAP files, collect packets in a list and use addBatch() + executeBatch() to reduce database round-trips.
• Error Handling: Add try/catch blocks for file corruption, missing protocol headers, and database connection failures.
• Packet Filtering: Use pcap.setFilter("tcp or udp") to only process relevant packets and speed up parsing.
• Progress Tracking: Update the JProgressBar in the process() method of SwingWorker to show parsing progress.

Let me know if you run into issues with library setup or database integration—I’m happy to help tweak this for your J-HONEYPOT project!

内容的提问来源于stack exchange，提问作者karthik_2410