URL browser origin in winpcap

is there anyway to know the origin(web browser) of a certain url/packet when programming 开发者_JAVA百科with winpcap and c++?

A URL is just an address string and isn't associated with any particular browser per se. A packet however is something sent, typically by an application. In the case of HTTP traffic, we can safely assume TCP. TCP packets always have 4 addressing fields: Originating IP, originating port, destination IP and destination port. Ports are assigned uniquely to a single application. In this case, the originating port will be assigned to the web browser, and the destination port to the web server.

Note that the destination port is probably 80, statically assigned to the web server, but the originating port is randomly assigned and can be reassigned later. Hence you need to look it up immediately.

Once you captured a tcp packet containing an HTTP payload, you will need to isolate the HTTP header as a string so you can work with it. Within the HTTP payload you will find the User-Agent Keyword(You will need to search the httpHeader string for it) and read the associated value. I think you can isolate HTTP header by doing the following

char* httpHeader = pkt_hdr + 14 + sizeof(TCP_header) + sizeof(IP_header)