public static ParsedDataSet ParseIPTWPData(IPTWPPacket iptwpPacket, UdpPacket udp, bool extensive)
{
if (iptwpPacket == null || iptwpPacket.IPTWPType == IPTTypes.MA)
{
return(null);
}
DataSetDefinition dataSetDefinition = null;
foreach (var collection in DataCollections)
{
var find = collection.FindByIdentifier(iptwpPacket.Comid.ToString());
if (find != null)
{
dataSetDefinition = find;
break;
}
}
if (dataSetDefinition != null)
{
try
{
var iptPayload = IPTWPPacket.GetIPTPayload(udp, iptwpPacket);
return(dataSetDefinition.Parse(iptPayload, extensive));
}
catch (Exception e)
{
return(ParsedDataSet.CreateError(e.Message));
}
}
return(null);
}
public static IPTWPPacket Extract(UdpPacket udp)
{
if (udp == null)
return null;
var iptPacket = new IPTWPPacket();
byte[] payload = udp.PayloadData;
if (udp.DestinationPort == 20548 || udp.DestinationPort == 20550)
{
if (payload.Length <= 28) // the minimum length of an empty iptwp packet
return null;
var header = ExtractHeader(payload);
ushort datasetlength = (ushort) header["DatasetLength"];
// calculate what the total size of the packet should be, header + framecheck for header + datasetlength
int totalsize = ((ushort) header["HeaderLength"]) + 4 + datasetlength;
// calculate the number of datasets and add the number of framechecks we should have
int datasets = (int) Math.Floor((double) (datasetlength / 256)) + 1;
totalsize += datasets * 4;
// calculate if there should be padding
if (datasetlength % 4 != 0)
{
int remainder = datasetlength % 4;
totalsize += 4 - remainder;
}
if (totalsize != payload.Length)
return null;
if (!MessageTypes.ContainsKey((ushort) header["Type"]))
return null;
// we have valid IPTCom!
iptPacket.Comid = (uint) header["ComID"];
iptPacket.IPTWPSize = datasetlength;
iptPacket.IPTWPType = MessageTypes[(ushort) header["Type"]];
}
else
{
return null;
}
return iptPacket;
}
//public byte[] IPTWPPayload { get; set; }
public static byte[] GetIPTPayload(UdpPacket udp, IPTWPPacket packet)
{
byte[] payload = udp.PayloadData;
ushort headerlength = BitConverter.ToUInt16(new[] {payload[23], payload[22]}, 0);
var data = new byte[packet.IPTWPSize];
ushort readpos =
headerlength; // the first framecheck will be skipped by the i % 256 modulus when it parses 0
for (var i = 0; i < packet.IPTWPSize; i++)
{
if (i % 256 == 0)
readpos += 4;
data[i] = payload[readpos];
readpos++;
}
return data;
}
public CapturePacket(Raw raw)
{
//RawCapture = raw;
Date = raw.TimeStamp;
_linkLayerType = raw.LinkLayer;
try
{
Packet = Packet.ParsePacket((LinkLayers)raw.LinkLayer, raw.RawData);
}
catch (Exception e)
{
Error = e.Message;
}
if (Packet == null)
{
return;
}
// protect against corrupted data with a try read
try
{
var throwaway = Packet.Bytes.Length + Packet.HeaderData.Length;
}
catch (Exception e)
{
_protocolinfo = "Malformed Packet or Header";
this.Error = "Malformed Packet or Header";
return;
}
if (Packet.PayloadPacket is IPv4Packet)
{
var ipv4 = (IPv4Packet)Packet.PayloadPacket;
switch (ipv4.Protocol)
{
case PacketDotNet.ProtocolType.Tcp:
var tcpPacket = (TcpPacket)ipv4.PayloadPacket;
Protocol = ProtocolType.TCP;
// catch a semi-rare error in PacketDotNet that cannot be checked against
try
{
if (tcpPacket.PayloadData.Length == 0)
{
break;
}
}
catch (Exception e)
{
Error = e.Message;
break;
}
if ((tcpPacket.DestinationPort == 50039 || tcpPacket.DestinationPort == 50040) &&
tcpPacket.PayloadData.Length > 0)
{
Protocol = ProtocolType.JRU;
try
{
var ss27 = ExtractSS27Packet(tcpPacket);
DisplayFields.Add(new Tuple <string, object>("time", ss27.DateTime));
if (ss27.Events.Count == 0)
{
// if there is no event, chuck some other data in there, maybe
// ParsedData = new ParsedDataSet() { ParsedFields = new List<ParsedField>(ss27.Header) };
}
else
{
// TODO FIX THIS SO IT WORKS
ss27.Events.ForEach(e => DisplayFields.Add(new Tuple <string, object>(e.EventType.ToString(), e.Description)));
}
this.SS27Packet = ss27;
}
catch (Exception e)
{
Error = e.Message;
}
}
if (tcpPacket.SourcePort == 50041 && tcpPacket.PayloadData.Length > 0)
{
Protocol = ProtocolType.JRU;
var jruload = tcpPacket.PayloadData;
try
{
ushort jrulen = BitConverter.ToUInt16(new byte[] { jruload[1], jruload[0] }, 0);
var buffer = new byte[jrulen];
Array.Copy(jruload, 2, buffer, 0, jrulen);
ParsedData = VSIS210.JRU_STATUS.Parse(buffer);
}
catch (Exception e)
{
Error = e.Message;
}
}
break;
case PacketDotNet.ProtocolType.Udp:
Protocol = ProtocolType.UDP;
var udp = (UdpPacket)ipv4.PayloadPacket;
if (udp == null)
{
_protocolinfo = "Malformed UDP";
this.Error = "Malformed UDP";
return;
}
// protect against corrupted data with a try read
try
{
var throwaway = udp.DestinationPort + udp.SourcePort + udp.Length + udp.Checksum;
}
catch (Exception e)
{
_protocolinfo = "Malformed UDP";
this.Error = "Malformed UDP";
return;
}
if (udp.SourcePort == 123 && udp.DestinationPort == 123)
{
Protocol = ProtocolType.NTP;
}
else if (Equals(ipv4.SourceAddress, VapAddress))
{
if (udp.DestinationPort == 50023)
{
_protocolinfo = "VAP->ETC (TR)";
}
else if (udp.DestinationPort == 50030)
{
_protocolinfo = "VAP->ETC (DMI1 to ETC)";
}
else if (udp.DestinationPort == 50031)
{
_protocolinfo = "VAP->ETC (DMI2 to ETC)";
}
else if (udp.DestinationPort == 50032)
{
_protocolinfo = "VAP->ETC (DMI1 to iSTM)";
}
else if (udp.DestinationPort == 50033)
{
_protocolinfo = "VAP->ETC (DMI2 to iSTM)";
}
else if (udp.DestinationPort == 50051)
{
_protocolinfo = "VAP->ETC (DMI1 to gSTM)";
}
else if (udp.DestinationPort == 50052)
{
_protocolinfo = "VAP->ETC (DMI2 to gSTM)";
}
else if (udp.DestinationPort == 50024)
{
_protocolinfo = "VAP->ETC (DMI1 EVC-102)";
}
else if (udp.DestinationPort == 50025)
{
_protocolinfo = "VAP->ETC (DMI2 EVC-102)";
}
else if (udp.DestinationPort == 50039)
{
_protocolinfo = "VAP->ETC (STM to JRU)";
}
else if (udp.DestinationPort == 50041)
{
_protocolinfo = "VAP->ETC (JRU Status)";
}
else if (udp.DestinationPort == 50050)
{
_protocolinfo = "VAP->ETC (VAP Status)";
}
else if (udp.DestinationPort == 50015)
{
Protocol = ProtocolType.UDP_SPL;
_protocolinfo = "VAP->OPC (DMI to STM)";
}
else if (udp.DestinationPort == 5514)
{
_protocolinfo = "VAP->BDS (VAP Diag)";
}
}
else if (Equals(ipv4.DestinationAddress, VapAddress))
{
if (udp.DestinationPort == 50022)
{
_protocolinfo = "ETC->VAP (OBU)";
}
else if (udp.DestinationPort == 50026)
{
_protocolinfo = "ETC->VAP (ETC to DMI1)";
}
else if (udp.DestinationPort == 50027)
{
_protocolinfo = "ETC->VAP (ETC to DMI2)";
}
else if (udp.DestinationPort == 50037)
{
_protocolinfo = "ETC->VAP (EVC-1&7)";
}
else if (udp.DestinationPort == 50035)
{
_protocolinfo = "ETC->VAP (EVC-1&7)";
}
else if (udp.DestinationPort == 50028)
{
_protocolinfo = "ETC->VAP (iSTM to DMI1)";
}
else if (udp.DestinationPort == 50029)
{
_protocolinfo = "ETC->VAP (iSTM to DMI2)";
}
else if (udp.DestinationPort == 50055)
{
_protocolinfo = "ETC->VAP (gSTM to DMI1)";
}
else if (udp.DestinationPort == 50056)
{
_protocolinfo = "ETC->VAP (gSTM to DMI2)";
}
else if (udp.DestinationPort == 50034)
{
_protocolinfo = "ETC->VAP (to JRU)";
}
else if (udp.DestinationPort == 50057)
{
_protocolinfo = "ETC->VAP (VAP Config)";
}
else if (udp.DestinationPort == 50014)
{
Protocol = ProtocolType.UDP_SPL;
_protocolinfo = "OPC->VAP";
var payload = udp.PayloadData;
var spl = VAP.UDP_SPL.Parse(payload);
this.DisplayFields =
spl.ParsedFields.Select(f => new Tuple <string, object>(f.Name, f.Value)).ToList();
if (spl.ParsedFields.Last().Value.Equals("C9"))
{
var nextBytes = Functions.SubArrayGetter(payload, 81);
var stm = VAP.STM_Packet.Parse(nextBytes);
DisplayFields.AddRange(stm.ParsedFields.Select(f => new Tuple <string, object>(f.Name, f.Value)).ToList());
}
}
else if (udp.DestinationPort == 50036)
{
_protocolinfo = "BDS->VAP (Diag)";
}
else if (udp.DestinationPort == 50070)
{
_protocolinfo = "ETC->VAP (ATO)";
}
else if (udp.DestinationPort == 50068)
{
_protocolinfo = "ETC->VAP (ATO)";
}
else if (udp.DestinationPort == 50072)
{
_protocolinfo = "ETC->VAP (ATO)";
}
}
try
{
IPTWPPacket = IPTWPPacket.Extract(udp);
}
catch (Exception e)
{
Error = e.Message;
}
if (IPTWPPacket != null)
{
Protocol = ProtocolType.IPTWP;
}
break;
case PacketDotNet.ProtocolType.Icmp:
Protocol = ProtocolType.ICMP;
// dunno
break;
case PacketDotNet.ProtocolType.Igmp:
Protocol = ProtocolType.IGMP;
// dunno
break;
default:
throw new ArgumentOutOfRangeException();
}
}
else if (Packet.PayloadPacket is ArpPacket arpPacket)
{
Protocol = ProtocolType.ARP;
}
else if (Packet.PayloadPacket is IPv6Packet)
{
Protocol = ProtocolType.IPv6;
// ignore, for now
}
else if (raw.LinkLayer == LinkLayerType.Ethernet && Packet.HeaderData[12] == 0x88 &&
Packet.HeaderData[13] == 0xe1)
{
Protocol = ProtocolType.HomeplugAV;
// ignore
}
else if (raw.LinkLayer == LinkLayerType.Ethernet && Packet.HeaderData[12] == 0x89 &&
Packet.HeaderData[13] == 0x12)
{
Protocol = ProtocolType.Mediaxtream;
// ignore
}
else if (raw.LinkLayer == LinkLayerType.Ethernet && Packet.HeaderData[12] == 0x88 &&
Packet.HeaderData[13] == 0xcc)
{
Protocol = ProtocolType.LLDP;
// ignore
}
else
{
Protocol = ProtocolType.UNKNOWN;
#if DEBUG
// if we are in debug, we might want to know what is in the unknown
// throw new NotImplementedException("Surprise data! " + BitConverter.ToString(packet.Bytes));
#endif
}
var extractParsedData = ExtractParsedData(this, out var displayfields);
this.DisplayFields.AddRange(displayfields);
this.ParsedData = extractParsedData;
}