public static StringBuilder GetRequestResponseRawStream(IntPtr hParsedFrame, uint payLodId, int frameCount)
{
byte[] rawHTTPByte;
char[] rawHTTPChar;
UInt32 pulFieldOffset;
UInt32 pulFieldBitLength;
UInt32 ulReturnLength;
uint errno = 0;
string tempstring = null;
StringBuilder rawHTTPStringRequest = new StringBuilder();
StringBuilder rawHTTPStringResponse = new StringBuilder();
if (payLodId != 0)
{
errno = NetmonAPI.NmGetFieldOffsetAndSize(hParsedFrame, payLodId, out pulFieldOffset, out pulFieldBitLength);
if (errno == 0)
{
rawHTTPByte = new byte[pulFieldBitLength];
unsafe
{
fixed(byte *pstr = rawHTTPByte)
{
errno = NetmonAPI.NmGetFieldValueByteArray(hParsedFrame, payLodId, pulFieldBitLength, pstr, out ulReturnLength);
tempstring = Encoding.UTF8.GetString(rawHTTPByte, 0, rawHTTPByte.Length);
rawHTTPStringRequest.Append(tempstring);
}
}
}
}
else
{
for (uint j = 0; j < frameCount; j++)
{
errno = NetmonAPI.NmGetFieldOffsetAndSize(hParsedFrame, j, out pulFieldOffset, out pulFieldBitLength);
rawHTTPChar = new char[pulFieldBitLength];
unsafe
{
fixed(char *pstr = rawHTTPChar)
{
errno = NetmonAPI.NmGetFieldValueString(hParsedFrame, j, pulFieldBitLength, pstr);
if (errno == 0)
{
rawHTTPStringRequest.Append(rawHTTPChar);
}
}
}
}
}
return(rawHTTPStringRequest);
}
/// <summary>
/// Prints out a field's value if the display string couldn't be found.
/// </summary>
/// <param name="hParsedFrame">Parsed Frame</param>
/// <param name="fieldId">Field Number to Display</param>
private static void PrintParsedFrameFieldValue(IntPtr hParsedFrame, uint fieldId)
{
NmParsedFieldInfo parsedField = new NmParsedFieldInfo();
parsedField.Size = (ushort)System.Runtime.InteropServices.Marshal.SizeOf(parsedField);
uint errno = NetmonAPI.NmGetParsedFieldInfo(hParsedFrame, fieldId, parsedField.Size, ref parsedField);
if (errno == ERROR_SUCCESS)
{
if (parsedField.NplDataTypeNameLength != 0)
{
char[] name = new char[BUFFER_SIZE];
unsafe
{
fixed(char *pstr = name)
{
errno = NetmonAPI.NmGetFieldName(hParsedFrame, fieldId, NmParsedFieldNames.DataTypeName, BUFFER_SIZE, pstr);
}
}
Console.Write("(" + new string(name).Replace("\0", string.Empty) + ") ");
}
if (parsedField.FieldBitLength > 0)
{
byte number8Bit = 0;
ushort number16Bit = 0;
uint number32Bit = 0;
ulong number64Bit = 0;
ulong rl = parsedField.ValueBufferLength;
switch (parsedField.ValueType)
{
case FieldType.VT_UI1:
errno = NetmonAPI.NmGetFieldValueNumber8Bit(hParsedFrame, fieldId, out number8Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine(number8Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_I1:
errno = NetmonAPI.NmGetFieldValueNumber8Bit(hParsedFrame, fieldId, out number8Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine((sbyte)number8Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_UI2:
errno = NetmonAPI.NmGetFieldValueNumber16Bit(hParsedFrame, fieldId, out number16Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine(number16Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_I2:
errno = NetmonAPI.NmGetFieldValueNumber16Bit(hParsedFrame, fieldId, out number16Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine((short)number16Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_UI4:
errno = NetmonAPI.NmGetFieldValueNumber32Bit(hParsedFrame, fieldId, out number32Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine(number32Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_I4:
errno = NetmonAPI.NmGetFieldValueNumber32Bit(hParsedFrame, fieldId, out number32Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine((int)number32Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_UI8:
errno = NetmonAPI.NmGetFieldValueNumber64Bit(hParsedFrame, fieldId, out number64Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine(number64Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_I8:
errno = NetmonAPI.NmGetFieldValueNumber64Bit(hParsedFrame, fieldId, out number64Bit);
if (errno == ERROR_SUCCESS)
{
Console.WriteLine((long)number64Bit);
}
else
{
Console.WriteLine("Error " + errno);
}
break;
case FieldType.VT_ARRAY | FieldType.VT_UI1:
byte[] byteArray = new byte[BUFFER_SIZE];
unsafe
{
fixed(byte *barr = byteArray)
{
errno = NetmonAPI.NmGetFieldValueByteArray(hParsedFrame, fieldId, BUFFER_SIZE, barr, out number32Bit);
}
}
if (errno == ERROR_SUCCESS)
{
for (uint i = 0; i < number32Bit; i++)
{
Console.Write(byteArray[i].ToString("X2") + " ");
}
if ((parsedField.FieldBitLength >> 3) > number32Bit)
{
Console.Write(" ... " + ((parsedField.FieldBitLength >> 3) - number32Bit) + " more bytes not displayed");
}
Console.WriteLine();
}
else if (errno == ERROR_RESOURCE_NOT_AVAILABLE)
{
Console.WriteLine("The field is a container");
}
break;
case FieldType.VT_LPWSTR:
char[] name = new char[BUFFER_SIZE];
unsafe
{
fixed(char *pstr = name)
{
errno = NetmonAPI.NmGetFieldValueString(hParsedFrame, fieldId, BUFFER_SIZE, pstr);
}
}
if (errno == ERROR_SUCCESS)
{
Console.WriteLine(new string(name).Replace("\0", string.Empty));
}
else
{
Console.WriteLine("String is too long to display");
}
break;
case FieldType.VT_LPSTR:
Console.WriteLine("Should not occur");
break;
case FieldType.VT_EMPTY:
Console.WriteLine("Struct or Array types expect description");
break;
default:
Console.WriteLine("Unknown Type " + parsedField.ValueType);
break;
}
}
else
{
Console.WriteLine("Empty");
}
}
else
{
Console.WriteLine("Could Not Retrieve Parsed Field Info " + errno);
}
}
