Beispiel #1
0
        public static void Pack(Conversation conversation, Frame frame, MessageType type, String content)
        {
            if (null == conversation)
            {
                throw new ArgumentNullException("conversation");
            }

            if (null == frame)
            {
                throw new ArgumentNullException("frame");
            }

            String httpFilename = FrameHelper.GetFrameFilename(conversation, frame, type);
            String http         = TSharkHelper.GetProtocolDetails(content, TSharkHelper.HEADER_HTTP);

            File.WriteAllText(httpFilename, http);

            String folder   = FrameHelper.GetFrameFolder(conversation, frame, type);
            String filename = String.Join(".", Path.GetFileNameWithoutExtension(httpFilename), CTTSettings.EXTENSION_XML);

            String xmlFilename = Path.Combine(folder, filename);
            String xml         = TSharkHelper.GetProtocolDetails(content, TSharkHelper.HEADER_XML);

            File.WriteAllText(xmlFilename, xml);
        }
        private void Run(IQuery query)
        {
            var timer = new Stopwatch();

            timer.Start();

            String args = query.Build();

            mTsharkProcess = CmdUtil.StartProcess(TSharkHelper.GetTSharkPath(), args);

            timer.Stop();
            Console.WriteLine("TShark query:\"{0}\" {1} ms ellapsed", args, timer.ElapsedMilliseconds);
        }
Beispiel #3
0
        public static void Pack(Conversation conversation, Frame frame, MessageType type, String content)
        {
            if (null == conversation)
            {
                throw new ArgumentNullException("conversation");
            }

            if (null == frame)
            {
                throw new ArgumentNullException("frame");
            }

            content = TSharkHelper.GetFrameWithoutHeader(content);

            String[] lines   = content.SplitToLines();
            String   cSeqStr = lines.FirstOrDefault(item => item.Contains("CSeq"));

            if (null == cSeqStr)
            {
                return;
            }

            cSeqStr = cSeqStr.Substring(cSeqStr.IndexOf(":", StringComparison.Ordinal) + 1).Trim();
            int cSeq = int.Parse(cSeqStr);

            switch (type)
            {
            case MessageType.Request:
                RtspMethod method = GetMethod(lines.First(item => item.Contains("Method")));
                conversation.Add(new RequestResponsePair(new RtspRequest(frame, conversation, cSeq, method), null, frame.FoundInTrace, conversation, ContentType.Rtsp));
                break;

            case MessageType.Response:
                var pair = conversation.GetMessages(ContentType.Rtsp).FirstOrDefault(item => item.GetRequest <RtspRequest>().CSeq == cSeq && item.Response.IsEmpty);

                if (null != pair)
                {
                    pair.SetResponse(new RtspResponse(frame, conversation, cSeq));
                }
                break;
            }

            String filename = FrameHelper.GetFrameFilename(conversation, frame, type);

            File.WriteAllText(filename, content);
        }
Beispiel #4
0
        private void ParseConversations()
        {
            String args = String.Format("{0} \"{1}\" {2} {3} {4} {3} {5} {3} {6} {3} {7} {8} \"{9}.{10}\"",
                                        TSharkHelper.ARG_READ_FILE,
                                        NetworkTrace.FullName,
                                        TSharkHelper.FILTER_FIELDS,
                                        TSharkHelper.FIELD,
                                        TSharkHelper.FIELD_REQUEST_IN,
                                        TSharkHelper.FIELD_FRAME_NUMBER,
                                        TSharkHelper.FIELD_MAC_DST,
                                        TSharkHelper.FIELD_MAC_SRC,
                                        TSharkHelper.ARG_DISPLAY_FILTER,
                                        CTTSettings.PROTOCOL_HTTP,
                                        CTTSettings.FILTER_RESPONSE);

            String output;

            if (!TSharkHelper.RunTShark(args, out output))
            {
                return;
            }

            var detectedDevices = FrameList.GetDevices();

            String[] lines = output.SplitToLines();
            foreach (String[] parts in lines.Select(line => line.Split(TSharkHelper.OUTPUT_SEPARATOR)))
            {
                int requestFrameNumber;
                int responseFrameNumber;

                int.TryParse(parts[0], out requestFrameNumber); // 0 as default value if TryParse failed

                if (0 == requestFrameNumber)
                {
                    continue;
                }

                int.TryParse(parts[1], out responseFrameNumber);

                String clientMac = parts[2];
                String deviceMac = parts[3];

                Unit client = UnitSet.GetUnit(clientMac);

                if (null == client)
                {
                    var macIpPair = detectedDevices.First(item => item.Item1 == clientMac);
                    client = new Client(NetworkTrace, macIpPair.Item1, macIpPair.Item2);
                    UnitSet.Add(client);
                }
                else
                {
                    client.FoundInTraces.Add(NetworkTrace);
                }

                Unit device = UnitSet.GetUnit(deviceMac);

                if (null == device)
                {
                    var macIpPair = detectedDevices.First(item => item.Item1 == deviceMac);
                    device = new Device(NetworkTrace, macIpPair.Item1, macIpPair.Item2);
                    UnitSet.Add(device);
                }
                else
                {
                    device.FoundInTraces.Add(NetworkTrace);
                }

                var conversation = ConversationList.Find(client, device);

                if (null == conversation)
                {
                    conversation = new Conversation(NetworkTrace, client, device);
                    ConversationList.Add(conversation);
                }

                conversation.FoundInTraces.Add(NetworkTrace);
                Directory.CreateDirectory(ConversationHelper.GetConversationFolder(NetworkTrace, conversation));

                var request  = new HttpRequest(FrameList.GetFrame(requestFrameNumber), conversation);
                var response = new HttpResponse(FrameList.GetFrame(responseFrameNumber), conversation);

                conversation.Add(new RequestResponsePair(request, response, NetworkTrace, conversation, ContentType.Http));
            }
        }