public async Task TestTimeWindowConversationProcessor()
        {
            var pcapPath = Path.Combine(TestEnvironment.DataPath, "testbed-32.pcap");
            var sw       = new Stopwatch();

            sw.Start();
            var observable   = SharpPcapReader.CreateObservable(pcapPath).Select(TestHelperFunctions.GetPacketAndKey);
            var windows      = observable.TimeSpanWindow(t => t.Ticks, TimeSpan.FromSeconds(60));
            var windowCount  = 0;
            var totalPackets = 0;
            await windows.Do(_ => windowCount++).ForEachAsync(async window =>
            {
                var flowProcessor = new NetFlowProcessor();

                await window.Do(_ => totalPackets++).ForEachAsync(p => flowProcessor.OnNext(p));

                // Get the results:
                Console.WriteLine($"# Window {windowCount}");
                Console.WriteLine($"Flows = {flowProcessor.Count},  Packets = {totalPackets}");
                Console.WriteLine();
                Console.WriteLine("| Date first seen | Duration | Proto | Src IP Addr:Port | Dst IP Addr:Port | Packets | Bytes |");
                Console.WriteLine("| --------------- | -------- | ----- | ---------------- | ---------------- | ------- | ----- |");

                foreach (var flow in flowProcessor.GetConversations(flowProcessor.GetConversationKey))
                {
                    Console.WriteLine($"| {new DateTime(flow.Value.Value.FirstSeen)} |  {new TimeSpan(flow.Value.Value.LastSeen - flow.Value.Value.FirstSeen)} | {flow.Key.FlowKey.ProtocolType} | {flow.Key.FlowKey.SourceIpAddress}:{flow.Key.FlowKey.SourcePort} | {flow.Key.FlowKey.DestinationIpAddress}:{flow.Key.FlowKey.DestinationPort} | {flow.Value.Value.Packets} | {flow.Value.Value.Octets} |");
                }
                Console.WriteLine();
            });
        }
Beispiel #2
0
 public async Task ExportWindowedFlowsByProcessor()
 {
     var packets      = SharpPcapReader.CreateObservable(dataset).Select(GetPacketAndKey);
     var windows      = packets.TimeSpanWindow(t => t.Ticks, TimeSpan.FromMinutes(5));
     var windowCount  = 0;
     var totalPackets = 0;
     await windows.ForEachAsync(async window =>
     {
         windowCount++;
         var flowProcessor = new NetFlowProcessor();
         await window.Do(_ => totalPackets++).ForEachAsync(p => flowProcessor.OnNext(p));
         Console.WriteLine($"Window = {windowCount},  Flows = {flowProcessor.Count},  Packets = {totalPackets}");
     });
 }