internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload, FlagsRadioTapField flagsField)
{
var payloadPacketOrData = new PacketOrByteArraySegment();
MacFrame frame = null;
if (flagsField != null)
{
bool fcsPresent = ((flagsField.Flags & RadioTapFlags.FcsIncludedInFrame) == RadioTapFlags.FcsIncludedInFrame);
if (fcsPresent)
{
frame = MacFrame.ParsePacketWithFcs(payload);
}
else
{
frame = MacFrame.ParsePacket(payload);
}
}
else
{
frame = MacFrame.ParsePacket(payload);
}
if (frame == null)
{
payloadPacketOrData.TheByteArraySegment = payload;
}
else
{
payloadPacketOrData.ThePacket = frame;
}
return(payloadPacketOrData);
}
/// <summary>
/// Parses the <see cref="PacketDotNet.Utils.ByteArraySegment"/> into a MacFrame.
/// </summary>
/// <returns>
/// The parsed MacFrame or null if it could not be parsed.
/// </returns>
/// <param name='bas'>
/// The bytes of the packet. bas.Offset should point to the first byte in the mac frame.
/// </param>
/// <remarks>If the provided bytes dont contain the FCS then call <see cref="MacFrame.ParsePacket"/> instead. The presence of the
/// FCS is usually determined by configuration of the device used to capture the packets.</remarks>
public static MacFrame ParsePacketWithFcs(ByteArraySegment bas)
{
if (bas.Length < (MacFields.FrameControlLength + MacFields.FrameCheckSequenceLength))
{
//There isn't enough data for there to be an FCS and a packet
return(null);
}
//remove the FCS from the buffer that we will pass to the packet parsers
ByteArraySegment basWithoutFcs = new ByteArraySegment(bas.Bytes,
bas.Offset,
bas.Length - MacFields.FrameCheckSequenceLength,
bas.BytesLength - MacFields.FrameCheckSequenceLength);
UInt32 fcs = EndianBitConverter.Big.ToUInt32(bas.Bytes,
(bas.Offset + bas.Length) - MacFields.FrameCheckSequenceLength);
MacFrame frame = ParsePacket(basWithoutFcs);
if (frame != null)
{
frame.AppendFcs = true;
frame.FrameCheckSequence = fcs;
}
return(frame);
}
/// <summary>
/// Used by the Ieee80211PpiPacket constructor.
/// </summary>
/// <param name="header">
/// A <see cref="ByteArraySegment"/>
/// </param>
/// <param name="commonField">
/// The <see cref="PpiCommon"/> object in the PPI packet or null if not available
/// </param>
/// <returns>
/// A <see cref="PacketOrByteArraySegment"/>
/// </returns>
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment header, PpiCommon commonField)
{
// slice off the payload
var payload = header.EncapsulatedBytes();
var payloadPacketOrData = new PacketOrByteArraySegment();
MacFrame frame = null;
if (commonField != null)
{
bool fcsPresent = ((commonField.Flags & PpiCommon.CommonFlags.FcsIncludedInFrame) == PpiCommon.CommonFlags.FcsIncludedInFrame);
if (fcsPresent)
{
frame = MacFrame.ParsePacketWithFcs(payload);
}
else
{
frame = MacFrame.ParsePacket(payload);
}
}
else
{
frame = MacFrame.ParsePacket(payload);
}
if (frame == null)
{
payloadPacketOrData.TheByteArraySegment = payload;
}
else
{
payloadPacketOrData.ThePacket = frame;
}
return(payloadPacketOrData);
}
/// <summary>
/// Parses the <see cref="PacketDotNet.Utils.ByteArraySegment"/> into a MacFrame.
/// </summary>
/// <returns>
/// The parsed MacFrame or null if it could not be parsed.
/// </returns>
/// <param name='bas'>
/// The bytes of the packet. bas.Offset should point to the first byte in the mac frame.
/// </param>
/// <remarks>If the provided bytes contain the FCS then call <see cref="MacFrame.ParsePacketWithFcs"/> instead. The presence of the
/// FCS is usually determined by configuration of the device used to capture the packets.</remarks>
public static MacFrame ParsePacket(ByteArraySegment bas)
{
if (bas.Length < MacFields.FrameControlLength)
{
//there isn't enough data to even try and work out what type of packet it is
return(null);
}
//this is a bit ugly as we will end up parsing the framecontrol field twice, once here and once
//inside the packet constructor. Could create the framecontrol and pass it to the packet but I think that is equally ugly
FrameControlField frameControl = new FrameControlField(
EndianBitConverter.Big.ToUInt16(bas.Bytes, bas.Offset));
MacFrame macFrame = null;
log.DebugFormat("SubType {0}", frameControl.SubType);
switch (frameControl.SubType)
{
case FrameControlField.FrameSubTypes.ManagementAssociationRequest:
{
macFrame = new AssociationRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAssociationResponse:
{
macFrame = new AssociationResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReassociationRequest:
{
macFrame = new ReassociationRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReassociationResponse:
{
macFrame = new AssociationResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementProbeRequest:
{
macFrame = new ProbeRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementProbeResponse:
{
macFrame = new ProbeResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReserved0:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementReserved1:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementBeacon:
{
macFrame = new BeaconFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementATIM:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementDisassociation:
{
macFrame = new DisassociationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAuthentication:
{
macFrame = new AuthenticationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementDeauthentication:
{
macFrame = new DeauthenticationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAction:
{
macFrame = new ActionFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReserved3:
break; //TODO
case FrameControlField.FrameSubTypes.ControlBlockAcknowledgmentRequest:
{
macFrame = new BlockAcknowledgmentRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlBlockAcknowledgment:
{
macFrame = new BlockAcknowledgmentFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlPSPoll:
break; //TODO
case FrameControlField.FrameSubTypes.ControlRTS:
{
macFrame = new RtsFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCTS:
{
macFrame = new CtsFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlACK:
{
macFrame = new AckFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCFEnd:
{
macFrame = new ContentionFreeEndFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCFEndCFACK:
break; //TODO
case FrameControlField.FrameSubTypes.Data:
case FrameControlField.FrameSubTypes.DataCFACK:
case FrameControlField.FrameSubTypes.DataCFPoll:
case FrameControlField.FrameSubTypes.DataCFAckCFPoll:
{
macFrame = new DataDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.DataNullFunctionNoData:
case FrameControlField.FrameSubTypes.DataCFAckNoData:
case FrameControlField.FrameSubTypes.DataCFPollNoData:
case FrameControlField.FrameSubTypes.DataCFAckCFPollNoData:
{
macFrame = new NullDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.QosData:
case FrameControlField.FrameSubTypes.QosDataAndCFAck:
case FrameControlField.FrameSubTypes.QosDataAndCFPoll:
case FrameControlField.FrameSubTypes.QosDataAndCFAckAndCFPoll:
{
macFrame = new QosDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.QosNullData:
case FrameControlField.FrameSubTypes.QosCFAck:
case FrameControlField.FrameSubTypes.QosCFPoll:
case FrameControlField.FrameSubTypes.QosCFAckAndCFPoll:
{
macFrame = new QosNullDataFrame(bas);
break;
}
default:
//this is an unsupported (and unknown) packet type
break;
}
return(macFrame);
}