public static bool Parser(byte [] PacketData,
ref int Index,
ref ListViewItem LItem, ref string TypeInfo,
ref uint PreviousHttpSequence,
ref ushort LastTftpPort)
{
PACKET_LLC PLlc;
bool IsSnap = false;
try
{
PLlc.DSAP = PacketData[Index++];
PLlc.SSAP = PacketData[Index++];
IsSnap = (PLlc.DSAP == Const.LLC_TYPE_SNAP) && (PLlc.SSAP == Const.LLC_TYPE_SNAP) ? true : false;
PLlc.ControlField = (ushort)PacketData[Index++];
if ((PLlc.ControlField & 0xfc) != Const.XDLC_U)
{
PLlc.ControlField *= 256;
PLlc.ControlField += (ushort)PacketData[Index++];
}
if (IsSnap)
{
PLlc.OrganizationCode = Function.Get3Bytes(PacketData, ref Index, Const.NORMAL);
PLlc.ProtocolId = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
}
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "LLC";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Logical link control protocol";
PLlc.OrganizationCode = 0;
if (IsSnap)
{
switch (PLlc.OrganizationCode)
{
case Const.OUI_ENCAP_ETHER:
case Const.OUI_CISCO_90:
case Const.OUI_APPLE_ATALK:
//capture_ethertype(etype, pd, offset+8, len, ld);
//PacketETHERNET.Parser( PacketData , ref Index , ref LItem , ref PreviousHttpSequence , ref LastTftpPort );
break;
case Const.OUI_CISCO:
PacketCDP.Parser(PacketData, ref Index, ref LItem);
break;
default: break;
}
}
else
{
// non-SNAP
switch (PLlc.DSAP)
{
case Const.LLCSAP_IP:
PacketINTERNET.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort);
break;
case Const.LLC_TYPE_NOVELL_NETWARE:
TypeInfo = "IPX";
PacketIPX.Parser(PacketData, ref Index, ref LItem);
break;
case Const.LLC_TYPE_IBM_NETBIOS:
TypeInfo = "NetBIOS";
PacketNETBIOS.Parser(PacketData, ref Index, ref LItem);
break;
case Const.LLC_TYPE_STP:
PacketSTP.Parser(PacketData, ref Index, ref LItem);
break;
default:
break;
}
}
}
catch
{
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
public static bool Parser(ref TreeNodeCollection mNode,
byte [] PacketData,
ref ListViewItem LItem,
ref uint PreviousHttpSequence,
ref ushort LastTftpPort)
{
TreeNode mNodex;
string Tmp = "";
int Index = 0;
PACKET_ETHERNET PEthernet;
mNodex = new TreeNode();
mNodex.Text = "ETHERNET";
Function.SetPosition(ref mNodex, Index, Const.LENGTH_OF_ETHERNET, true);
if ((Index + Const.LENGTH_OF_ETHERNET) > PacketData.Length)
{
mNode.Add(mNodex);
Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp;
return(false);
}
try
{
PEthernet.Destination = Function.GetMACAddress(PacketData, ref Index);;
Tmp = "Destination : " + PEthernet.Destination;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 6, 6, false);
PEthernet.Source = Function.GetMACAddress(PacketData, ref Index);;
Tmp = "Source : " + PEthernet.Source;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 6, 6, false);
PEthernet.Type = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
if (PEthernet.Type <= 1500)
{
Tmp = "Length : " + Function.ReFormatString(PEthernet.Type, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
else
{
Tmp = "Type : " + Function.ReFormatString(PEthernet.Type, Const.GetETHERTYPEStr(PEthernet.Type));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ETHERNET";
LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PEthernet.Source;
LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PEthernet.Destination;
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Ethernet protocol";
mNode.Add(mNodex);
if (PEthernet.Type <= 1500)
{
PacketLLC.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort);
}
else
{
switch (PEthernet.Type)
{
case Const.ETHERTYPE_PUP:
break;
case Const.ETHERTYPE_SPRITE:
break;
case Const.ETHERTYPE_NS:
break;
case Const.ETHERTYPE_TRAIL:
break;
case Const.ETHERTYPE_MOPDL:
break;
case Const.ETHERTYPE_MOPRC:
break;
case Const.ETHERTYPE_DN:
break;
case Const.ETHERTYPE_LAT:
break;
case Const.ETHERTYPE_SCA:
break;
case Const.ETHERTYPE_IP:
PacketINTERNET.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort);
break;
case Const.ETHERTYPE_ARP:
PacketARP.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
case Const.ETHERTYPE_REVARP:
break;
case Const.ETHERTYPE_LANBRIDGE:
break;
case Const.ETHERTYPE_DECDNS:
break;
case Const.ETHERTYPE_DECDTS:
break;
case Const.ETHERTYPE_VEXP:
break;
case Const.ETHERTYPE_VPROD:
break;
case Const.ETHERTYPE_ATALK:
break;
case Const.ETHERTYPE_AARP:
break;
case Const.ETHERTYPE_8021Q:
break;
case Const.ETHERTYPE_IPX:
PacketIPX.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
case Const.ETHERTYPE_IPV6:
break;
case Const.ETHERTYPE_LOOPBACK:
PacketLOOPBACK.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
}
}
}
catch (Exception Ex)
{
mNode.Add(mNodex);
Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
public static bool Parser(ref TreeNodeCollection mNode,
byte [] PacketData,
ref int Index,
ref ListViewItem LItem,
ref uint PreviousHttpSequence,
ref ushort LastTftpPort)
{
TreeNode mNodex;
string Tmp = "";
PACKET_LLC PLlc;
bool UNFrame, IsSnap = false;
int kk = 0;
mNodex = new TreeNode();
mNodex.Text = "LLC ( Logical Link Control Protocol )";
kk = Index;
try
{
PLlc.DSAP = PacketData[Index++];
Tmp = "DSAP : " + Function.ReFormatString(PLlc.DSAP, GetLLCTypeString(PLlc.DSAP));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PLlc.SSAP = PacketData[Index++];
Tmp = "SSAP : " + Function.ReFormatString(PLlc.SSAP, GetLLCTypeString(PLlc.SSAP));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
IsSnap = (PLlc.DSAP == Const.LLC_TYPE_SNAP) && (PLlc.SSAP == Const.LLC_TYPE_SNAP) ? true : false;
PLlc.ControlField = (ushort)PacketData[Index++];
UNFrame = true;
if ((PLlc.ControlField & Const.XDLC_U) != Const.XDLC_U)
{
PLlc.ControlField *= 256;
PLlc.ControlField += (ushort)PacketData[Index++];
UNFrame = false;
}
Tmp = "Control Field : " + Function.ReFormatString(PLlc.ControlField, null);
mNodex.Nodes.Add(Tmp);
if (UNFrame)
{
Function.SetPosition(ref mNodex, Index - 1, 1, false);
}
else
{
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
PLlc.OrganizationCode = 0;
if (IsSnap)
{
PLlc.OrganizationCode = Function.Get3Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Organization Code : " + Function.ReFormatString(PLlc.OrganizationCode, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 3, 3, false);
PLlc.ProtocolId = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Protocol Id : " + Function.ReFormatString(PLlc.ProtocolId, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "LLC";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Logical link control protocol";
Function.SetPosition(ref mNodex, kk, Index - kk, true);
mNode.Add(mNodex);
if (IsSnap)
{
switch (PLlc.OrganizationCode)
{
case Const.OUI_ENCAP_ETHER:
case Const.OUI_CISCO_90:
case Const.OUI_APPLE_ATALK:
//capture_ethertype(etype, pd, offset+8, len, ld);
//PacketETHERNET.Parser( ref mNode , PacketData , ref LItem , ref PreviousHttpSequence , ref LastTftpPort );
break;
case Const.OUI_CISCO:
PacketCDP.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
default: break;
}
}
else
{
// non-SNAP
switch (PLlc.DSAP)
{
case Const.LLCSAP_IP:
PacketINTERNET.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort);
break;
case Const.LLC_TYPE_NOVELL_NETWARE:
PacketIPX.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
case Const.LLC_TYPE_IBM_NETBIOS:
PacketNETBIOS.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
case Const.LLC_TYPE_STP:
PacketSTP.Parser(ref mNode, PacketData, ref Index, ref LItem);
break;
default:
break;
}
}
}
catch (Exception Ex)
{
mNode.Add(mNodex);
Tmp = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
public static bool Parser(byte [] PacketData,
ref ListViewItem LItem,
ref string TypeInfo,
ref uint PreviousHttpSequence,
ref ushort LastTftpPort)
{
string Tmp = "";
int Index = 0;
PACKET_ETHERNET PEthernet;
if ((Index + Const.LENGTH_OF_ETHERNET) > PacketData.Length)
{
Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp;
return(false);
}
try
{
PEthernet.Destination = Function.GetMACAddress(PacketData, ref Index);;
PEthernet.Source = Function.GetMACAddress(PacketData, ref Index);;
PEthernet.Type = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ETHERNET";
LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PEthernet.Source;
LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PEthernet.Destination;
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Ethernet protocol";
if (PEthernet.Type <= 1500)
{
PacketLLC.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort);
}
else
{
switch (PEthernet.Type)
{
case Const.ETHERTYPE_PUP:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_SPRITE:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_NS:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_TRAIL:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_MOPDL:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_MOPRC:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_DN:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_LAT:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_SCA:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_IP:
TypeInfo = "Other";
PacketINTERNET.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort);
break;
case Const.ETHERTYPE_ARP:
TypeInfo = "Other";
PacketARP.Parser(PacketData, ref Index, ref LItem);
break;
case Const.ETHERTYPE_REVARP:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_LANBRIDGE:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_DECDNS:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_DECDTS:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_VEXP:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_VPROD:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_ATALK:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_AARP:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_8021Q:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_IPX:
TypeInfo = "IPX";
PacketIPX.Parser(PacketData, ref Index, ref LItem);
break;
case Const.ETHERTYPE_IPV6:
TypeInfo = "Other";
break;
case Const.ETHERTYPE_LOOPBACK:
TypeInfo = "Other";
PacketLOOPBACK.Parser(PacketData, ref Index, ref LItem);
break;
}
}
}
catch
{
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
