private void OnTrace(IPHeader tlsPackage)
{
if (Trace != null)
{
Trace(tlsPackage, EventArgs.Empty);
}
}
void s_IpPacketSent(object sender, EventArgs e)
{
IPHeader ipHeader = (IPHeader)sender;
if (ipHeader.ProtocolType == Protocol.Tcp)
{
try {
TCPHeader tcp = new TCPHeader(ipHeader.Data, ipHeader.MessageLength);
int sourcePort;
if (int.TryParse(tcp.SourcePort, out sourcePort))
{
if (sourcePort == ((SmtpConfig)Configuration.AgentSettings).SmtpPort)
{
if (Tracing)
{
OnTrace((IPHeader)sender);
}
if (tcp.Data.Length > 0)
{
AppLayerSmtp ftp = new AppLayerSmtp(tcp.Data, tcp.Data.Length);
if (ftp.SmtpReplyCode == AppLayerSmtp.SMTP_REPLY_CODE_NEED_TO_AUTHENTICATE || ftp.SmtpReplyCode == AppLayerSmtp.SMTP_REPLY_CODE_LOGIN_DENIED)
{
UnsuccessfulLogin(ipHeader.DestinationAddress.ToString());
}
}
// Console.WriteLine("Flags: {0}\tAck: {1}\tSeq:{2}", tcp.Flags, tcp.AcknowledgementNumber, tcp.SequenceNumber);
// Console.WriteLine("Source: {0}:{1}\tDestination: {2}:{3}", ipHeader.SourceAddress, tcp.SourcePort, ipHeader.DestinationAddress, tcp.DestinationPort);
}
}
} catch (Exception ex) {
Sniffer.LogTrace(ex);
}
}
}
private void OnPacketSent(IPHeader ipHeader)
{
if (IpPacketSent != null)
{
IpPacketSent(ipHeader, EventArgs.Empty);
}
}
private void OnPacketReceived(IPHeader ipHeader)
{
if (IpPacketReceived != null)
{
IpPacketReceived(ipHeader, EventArgs.Empty);
}
}
private void OnReceive(IAsyncResult ar)
{
if (!aborted)
{
try {
int length = ipSocket.EndReceive(ar);
//ParseData(byteData, nReceived);
IPHeader ipHeader = new IPHeader(byteData, length);
if (ipHeader.SourceAddress.Equals(IPAddress))
{
OnPacketSent(ipHeader);
}
if (ipHeader.DestinationAddress.Equals(IPAddress))
{
OnPacketReceived(ipHeader);
}
// OnPacketReceived(new NetworkPacket(byteData,length));
} catch (Exception ex) {
// Sniffer.LogTrace(ex);
} finally {
byteData = new byte[128]; // set to 16276 bytes
// continue receiving
ipSocket.BeginReceive(byteData, 0, byteData.Length, SocketFlags.None,
new AsyncCallback(OnReceive), null);
}
}
}
void s_IpPacketSent(object sender, EventArgs e)
{
IPHeader ipHeader = (IPHeader)sender;
if (ipHeader.ProtocolType == Protocol.Tcp)
{
try {
TCPHeader tcp = new TCPHeader(ipHeader.Data, ipHeader.MessageLength);
int sourcePort;
int destinationPort;
if (int.TryParse(tcp.SourcePort, out sourcePort) && int.TryParse(tcp.DestinationPort, out destinationPort))
{
if (sourcePort == ((Pop3Config)Configuration.AgentSettings).Pop3Port)
{
if (tcp.Data.Length > 0)
{
AppLayerPop3 ftp = new AppLayerPop3(tcp.Data, tcp.Data.Length);
if (ftp.Pop3Code.ToUpper().Equals(AppLayerPop3.POP3_REPLY_CODE_ERROR.ToUpper()))
{
System.Threading.Thread.Sleep(100);
if (CurrentClients.ContainsKey(destinationPort) && CurrentClients[destinationPort].LastMessage == Pop3Message.PASS)
{
if (Tracing)
{
OnTrace((IPHeader)sender);
}
UnsuccessfulLogin(ipHeader.DestinationAddress.ToString());
}
}
}
// Console.WriteLine("Flags: {0}\tAck: {1}\tSeq:{2}", tcp.Flags, tcp.AcknowledgementNumber, tcp.SequenceNumber);
// Console.WriteLine("Source: {0}:{1}\tDestination: {2}:{3}", ipHeader.SourceAddress, tcp.SourcePort, ipHeader.DestinationAddress, tcp.DestinationPort);
}
}
} catch (Exception ex) {
Sniffer.LogTrace(ex);
}
}
}
void s_IpPacketReceived(object sender, EventArgs e)
{
IPHeader ipHeader = (IPHeader)sender;
if (ipHeader.ProtocolType == Protocol.Tcp)
{
try {
TCPHeader tcp = new TCPHeader(ipHeader.Data, ipHeader.MessageLength);
int sourcePort;
int destinationPort;
if (int.TryParse(tcp.SourcePort, out sourcePort) && int.TryParse(tcp.DestinationPort, out destinationPort))
{
if (destinationPort == ((Pop3Config)Configuration.AgentSettings).Pop3Port)
{
if (tcp.Data.Length > 0)
{
AppLayerPop3 pop3 = new AppLayerPop3(tcp.Data, tcp.Data.Length);
if (!CurrentClients.ContainsKey(sourcePort))
{
CurrentClients.Add(sourcePort, new Pop3Client());
}
CurrentClients[sourcePort].LastInteraction = DateTime.Now;
switch (pop3.Pop3Code.ToUpper())
{
case AppLayerPop3.POP3_INTERACTION_CODE_LIST:
CurrentClients[sourcePort].LastMessage = Pop3Message.LIST;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_DELE:
CurrentClients[sourcePort].LastMessage = Pop3Message.DELE;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_NOOP:
CurrentClients[sourcePort].LastMessage = Pop3Message.NOOP;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_PASS:
CurrentClients[sourcePort].LastMessage = Pop3Message.PASS;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_QUIT:
if (CurrentClients.ContainsKey(sourcePort))
{
CurrentClients.Remove(sourcePort);
}
break;
case AppLayerPop3.POP3_INTERACTION_CODE_RETR:
CurrentClients[sourcePort].LastMessage = Pop3Message.RETR;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_RSET:
CurrentClients[sourcePort].LastMessage = Pop3Message.RSET;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_STAT:
CurrentClients[sourcePort].LastMessage = Pop3Message.STAT;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_TOP:
CurrentClients[sourcePort].LastMessage = Pop3Message.TOP;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_UIDL:
CurrentClients[sourcePort].LastMessage = Pop3Message.UIDL;
break;
case AppLayerPop3.POP3_INTERACTION_CODE_USER:
CurrentClients[sourcePort].LastMessage = Pop3Message.USER;
break;
}
}
// Console.WriteLine("Flags: {0}\tAck: {1}\tSeq:{2}", tcp.Flags, tcp.AcknowledgementNumber, tcp.SequenceNumber);
// Console.WriteLine("Source: {0}:{1}\tDestination: {2}:{3}", ipHeader.SourceAddress, tcp.SourcePort, ipHeader.DestinationAddress, tcp.DestinationPort);
}
}
} catch (Exception ex) {
Sniffer.LogTrace(ex);
}
}
}
public void TestSend(byte[] data)
{
IPHeader hdr = new IPHeader(data, data.Length);
s_IpPacketSent(hdr, EventArgs.Empty);
}
public void TestReceive(byte[] data)
{
IPHeader hdr = new IPHeader(data, data.Length);
s_IpPacketReceived(hdr, EventArgs.Empty);
}