/// <summary>
/// Constructor
/// </summary>
/// <param name="linkLayerType">
/// A <see cref="PacketDotNet.LinkLayers"/>
/// </param>
/// <param name="snapshotLength">
/// A <see cref="System.Nullable<System.Int32>"/>
/// </param>
/// <param name="captureFilename">
/// A <see cref="System.String"/>
/// </param>
/// <param name="mode">
/// A <see cref="FileMode"/>
/// </param>
public CaptureFileWriterDevice(PacketDotNet.LinkLayers linkLayerType,
int?snapshotLength,
string captureFilename,
FileMode mode)
{
m_pcapFile = captureFilename;
// append isn't possible without some difficulty and not implemented yet
if (mode == FileMode.Append)
{
throw new System.InvalidOperationException("FileMode.Append is not supported, please contact the developers if you are interested in helping to implementing it");
}
if (!snapshotLength.HasValue)
{
snapshotLength = Pcap.MAX_PACKET_SIZE;
}
else if (snapshotLength > Pcap.MAX_PACKET_SIZE)
{
throw new System.InvalidOperationException("snapshotLength > Pcap.MAX_PACKET_SIZE");
}
// set the device handle
PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)linkLayerType, snapshotLength.Value);
m_pcapDumpHandle = LibPcapSafeNativeMethods.pcap_dump_open(PcapHandle, captureFilename);
if (m_pcapDumpHandle == IntPtr.Zero)
{
throw new PcapException("Error opening dump file '" + LastError + "'");
}
}
/// <summary>
/// Open the device
/// </summary>
public override void Open(DeviceConfiguration configuration)
{
// set the device handle
var has_open_dead_with_tstamp_precision_support = Pcap.LibpcapVersion >= new Version(1, 5, 1);
var resolution = configuration.TimestampResolution ?? TimestampResolution.Microsecond;
if (has_open_dead_with_tstamp_precision_support)
{
PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead_with_tstamp_precision((int)configuration.LinkLayerType,
configuration.Snaplen,
(uint)resolution);
}
else
{
if (resolution != TimestampResolution.Microsecond)
{
configuration.RaiseConfigurationFailed(
nameof(configuration.TimestampResolution),
(int)PcapError.PlatformNotSupported,
"pcap version is < 1.5.1, needs pcap_open_dead_with_tstamp_precision()"
);
}
PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)configuration.LinkLayerType, configuration.Snaplen);
}
m_pcapDumpHandle = LibPcapSafeNativeMethods.pcap_dump_open(PcapHandle, m_pcapFile);
if (m_pcapDumpHandle == IntPtr.Zero)
{
throw new PcapException("Error opening dump file '" + LastError + "'");
}
Active = true;
}
public static BpfProgram Create(LinkLayers linktype, string filter, int optimize = 1, uint netmask = 0)
{
using (var handle = LibPcapSafeNativeMethods.pcap_open_dead((int)linktype, Pcap.MAX_PACKET_SIZE))
{
return(Create(handle, filter, optimize, netmask));
}
}
private static bool GetIsHardwareAccelerated()
{
using (var handle = LibPcapSafeNativeMethods.pcap_open_dead(1, 60))
{
try
{
pcap_send_queue queue = default;
LibPcapSafeNativeMethods.pcap_sendqueue_transmit(handle, ref queue, 0);
return(true);
}
catch (TypeLoadException)
{
// Function pcap_sendqueue_transmit not found
return(false);
}
}
}
/// <summary>
/// Returns true if the filter expression was able to be compiled into a
/// program without errors
/// </summary>
public static bool CheckFilter(string filterExpression,
out string errorString)
{
IntPtr fakePcap = LibPcapSafeNativeMethods.pcap_open_dead((int)PacketDotNet.LinkLayers.Ethernet, Pcap.MAX_PACKET_SIZE);
uint mask = 0;
if (!CompileFilter(fakePcap, filterExpression, mask, out IntPtr bpfProgram, out errorString))
{
LibPcapSafeNativeMethods.pcap_close(fakePcap);
return(false);
}
FreeBpfProgram(bpfProgram);
LibPcapSafeNativeMethods.pcap_close(fakePcap);
return(true);
}
/// <summary>
/// Returns true if the filter expression was able to be compiled into a
/// program without errors
/// </summary>
public static bool CheckFilter(string filterExpression,
out string errorString)
{
errorString = null;
using (var pcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)PacketDotNet.LinkLayers.Ethernet, Pcap.MAX_PACKET_SIZE))
{
var bpfProgram = BpfProgram.TryCreate(pcapHandle, filterExpression);
if (bpfProgram == null)
{
errorString = GetLastError(pcapHandle);
return(false);
}
else
{
bpfProgram.Dispose();
return(true);
}
}
}