Example #1
0
 public Files()
 {
     this.protocol = "";
     this.request_type = "";
     this.packet_request = null;
     this.packet_header = null;
     this.file_name = "";
     this.file_data = null;
 }
Example #2
0
 public void update(System.Collections.ArrayList packets, int index)
 {
     try
     {
         packet pck = (packet)packets[index];
         this.packet_request = pck;
         this.protocol = pck.protocol;
         // 现在只有http的两个模式和ftp,待完善
         if (pck.info.IndexOf("GET") == 0)
         {
             this.request_type = "GET";
         }
         else if (pck.info.IndexOf("POST") == 0)
         {
             this.request_type = "POST";
         }
         else if (pck.info.IndexOf("Response: 150") == 0)
         {
             this.request_type = "FTP";
         }
         else
         {
             this.request_type = "UNKNOWN";
         }
         this.packet_header = this.find_header(packets, index, pck.tcp_info["AcknowledgmentNumber(确认序号)"]);
         this.charset = this.protocol == "HTTP" ? this.find_charset() : "";
         this.encoding = this.protocol == "HTTP" ? this.find_encoding() : "";
         this.file_data = this.find_data(packets, index, this.packet_header.tcp_info["AcknowledgmentNumber(确认序号)"]);
         this.file_name = this.find_fileName(pck);
         this.file_type = this.file_name.LastIndexOf(".") > 0 ? this.file_name.Substring(this.file_name.LastIndexOf(".") + 1) : "";
     }
     catch
     {
         return;
     }
 }
Example #3
0
        private bool _filter_check(packet Packet, string key, string oper, string value)
        {
            // 取出packet中对应key的value,string形式
            List<string> pac_value = new List<string>();
            switch (key)
            {
                case "ip_addr":
                    pac_value.Add(Packet.destIp);
                    pac_value.Add(Packet.srcIp);
                    break;
                case "port":
                    if (Packet.tcp_info.Count > 0)
                    {
                        pac_value.Add(Packet.tcp_info["SourcePort(源端口)"]);
                        pac_value.Add(Packet.tcp_info["DestinationPort(目的端口)"]);
                    }
                    if (Packet.udp_info.Count > 0)
                    {
                        pac_value.Add(Packet.udp_info["SourcePort(源端口)"]);
                        pac_value.Add(Packet.udp_info["DestinationPort(目的端口)"]);
                    }
                    break;
                case "ip_version":
                    if (Packet.ip_info.Count > 0)
                        pac_value.Add(Packet.ip_info["Version(版本)"]);
                    break;
                case "protocol":
                    if (Packet.ip_info.Count > 0)
                        pac_value.Add("IP");
                    if (Packet.tcp_info.Count > 0)
                        pac_value.Add("TCP");
                    if (Packet.udp_info.Count > 0)
                        pac_value.Add("UDP");
                    if (Packet.icmp_info.Count > 0)
                        pac_value.Add("ICMP");
                    if (Packet.igmp_info.Count > 0)
                        pac_value.Add("IGMP");
                    if (Packet.arp_info.Count > 0)
                        pac_value.Add("ARP");
                    if (Packet.application_info.Count > 0)
                        pac_value.Add(Packet.application_info["ApplicationType"]);
                    break;
                case "DF":
                    if (Packet.ip_info.Count > 0 && Packet.ip_info["Version(版本)"] == "IPV4")
                    {
                        pac_value.Add(Packet.ip_info["DF"]);
                    }
                    break;
                case "MF":
                    if (Packet.ip_info.Count > 0 && Packet.ip_info["Version(版本)"] == "IPV4")
                    {
                        pac_value.Add(Packet.ip_info["MF"]);
                    }
                    break;
                case "application_data":
                    if (Packet.application_info.Count > 0)
                        pac_value.Add(Packet.application_info["Data"]);
                    break;
                case "validate_checksum":
                    if (Packet.color == "Red")
                        return false ^ (oper == "!=");
                    else
                        return true ^ (oper =="!=");
                case "info_start":
                    pac_value.Add(Packet.info.Substring(0, value.Length));
                    break;
                default:
                    break;
            }

            switch (oper)
            {
                case "==":
                    if (include_array(pac_value, value))
                    {
                        return true;
                    }
                    break;
                case "!=":
                    if (!include_array(pac_value, value))
                    {
                        return true;
                    }
                    break;
                case "包含":
                    if (include_array_like(pac_value, value))
                        return true;
                    break;
                default:
                    return true;
            }
            return false;
        }
Example #4
0
        //当跨线程调用时,调用该方法进行UI界面更新
        /// <summary>
        /// 抓包后更新UI显示
        /// </summary>
        private void setDataGridView(packet Packet, int packet_index)
        {
            int index = this.dataGridView1.Rows.Add();
            this.dataGridView1.Rows[index].DefaultCellStyle.BackColor = Color.FromName(Packet.color);

            this.dataGridView1.Rows[index].Cells[0].Value = Packet.time;
            this.dataGridView1.Rows[index].Cells[1].Value = Packet.srcIp;
            this.dataGridView1.Rows[index].Cells[2].Value = Packet.destIp;
            this.dataGridView1.Rows[index].Cells[3].Value = Packet.protocol;
            this.dataGridView1.Rows[index].Cells[4].Value = Packet.info;
            this.dataGridView1.Rows[index].Cells[5].Value = packet_index;

            this.dataGridView1.FirstDisplayedScrollingRowIndex = this.dataGridView1.Rows.Count - 1;
        }
Example #5
0
        private void PcapPorcessContext(SharpPcap.RawCapture pPacket)
        {
            packet temp = new packet(pPacket);
            packets.Add(temp);

            if (this.dataGridView1.InvokeRequired)
            {
                //if (temp.ip_info.Count > 0 && temp.ip_info["Version(版本)"] == "IPv6" && temp.tcp_info.Count > 0)
                //if (temp.ip_info.Count > 0 && temp.ip_info["Version(版本)"] == "IPv4" && temp.ip_info["Protocol(协议)"] == "IGMP")
                filterCheckDelegate filterDelegate = filter_check;
                IAsyncResult asyncResult = filterDelegate.BeginInvoke(temp, null, null);
                bool flag = filterDelegate.EndInvoke(asyncResult);
                if (flag)
                {
                    this.dataGridView1.BeginInvoke(new setDataGridViewDelegate(setDataGridView), new object[] { temp, packets.Count - 1 });
                }
            }
            else
            {/*
                int index = this.dataGridView1.Rows.Add();
                this.dataGridView1.Rows[index].DefaultCellStyle.BackColor = Color.FromName(temp.color);
                this.dataGridView1.Rows[index].Cells[0].Value = temp.time;
                this.dataGridView1.Rows[index].Cells[1].Value = temp.srcIp;
                this.dataGridView1.Rows[index].Cells[2].Value = temp.destIp;
                this.dataGridView1.Rows[index].Cells[3].Value = temp.protocol;
                this.dataGridView1.Rows[index].Cells[4].Value = temp.info;
                this.dataGridView1.Rows[index].Cells[5].Value = packets.Count - 1;

                this.dataGridView1.FirstDisplayedScrollingRowIndex = this.dataGridView1.Rows.Count - 1;
            */}
        }
Example #6
0
 private bool filter_check(packet Packet)
 {
     bool flag = true;
     DataGridViewRowCollection rules = this.filter_rule.Rows;
     foreach (DataGridViewRow item in rules)
     {
         string key = (string)(item.Cells[0].Value);
         string oper = (string)(item.Cells[1].Value);
         string value = (string)(item.Cells[2].Value);
         flag = flag & _filter_check(Packet, key, oper, value);
     }
     return flag;
 }
Example #7
0
        private void button5_Click(object sender, EventArgs e)
        {
            if (this.is_saved == true || MessageBox.Show("不保存并读取文件?", "提示", MessageBoxButtons.YesNo, MessageBoxIcon.Question, MessageBoxDefaultButton.Button2) == DialogResult.Yes)
            {
                try
                {
                    this.device.StopCapture();
                    this.device.Close();
                }
                catch (Exception)
                {
                    ;
                }
                string capFile = "";
                OpenFileDialog ofd = new OpenFileDialog();
                ofd.InitialDirectory = Environment.GetFolderPath(Environment.SpecialFolder.Templates);
                ofd.Filter = "PCAP(*.pcap)|*.pcap";
                ofd.ValidateNames = true;
                ofd.CheckFileExists = true;
                ofd.CheckPathExists = true;
                if (ofd.ShowDialog() == DialogResult.OK)
                {
                    this.packets = new ArrayList();
                    this.dataGridView1.Rows.Clear();
                    capFile = ofd.FileName;
                    SharpPcap.LibPcap.CaptureFileReaderDevice captureFileReader = new SharpPcap.LibPcap.CaptureFileReaderDevice(capFile);

                    SharpPcap.RawCapture pPacket;

                    // Go through all packets in the file
                    while ((pPacket = captureFileReader.GetNextPacket()) != null)
                    {
                        try
                        {
                            packet temp = new packet(pPacket);
                            this.packets.Add(temp);

                            if (filter_check(temp))
                            {
                                if (this.dataGridView1.InvokeRequired)
                                {
                                    this.dataGridView1.BeginInvoke(new setDataGridViewDelegate(setDataGridView), new object[] { temp, this.packets.Count - 1 });
                                }
                                else
                                {
                                    int index = this.dataGridView1.Rows.Add();
                                    this.dataGridView1.Rows[index].DefaultCellStyle.BackColor = Color.FromName(temp.color);
                                    this.dataGridView1.Rows[index].Cells[0].Value = temp.time;
                                    this.dataGridView1.Rows[index].Cells[1].Value = temp.srcIp;
                                    this.dataGridView1.Rows[index].Cells[2].Value = temp.destIp;
                                    this.dataGridView1.Rows[index].Cells[3].Value = temp.protocol;
                                    this.dataGridView1.Rows[index].Cells[4].Value = temp.info;
                                    this.dataGridView1.Rows[index].Cells[5].Value = packets.Count - 1;

                                    this.dataGridView1.FirstDisplayedScrollingRowIndex = this.dataGridView1.Rows.Count - 1;
                                }
                            }
                        }
                        catch (Exception)
                        {
                            ;
                        }
                    }
                    this.is_saved = true;
                    captureFileReader.Close();
                    MessageBox.Show("读取完毕");
                }
            }
        }
Example #8
0
 private string find_fileName(packet pkt)
 {
     if (this.protocol == "HTTP")
     {
         string fileName = pkt.info.Split(' ')[1];
         return fileName.Substring(fileName.LastIndexOf("/") + 1);
     }
     else if (this.protocol == "FTP")
     {
         return pkt.info.Split(' ')[2];
     }
     return "";
 }