private void OnPacketArrival(object sender, CaptureEventArgs e) { var packet = EthernetPacket.ParsePacket(LinkLayers.Ethernet, e.Packet.Data); if (packet == null) { return; } packetBuffer.Enqueue((EthernetPacket)packet); packetsAvailable.Set(); }
private void OnPacketArrval(object sender, CaptureEventArgs e) { Packet packet = null; try { packet = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data); } catch { return; } IPAddress source = IPAddress.Parse("127.0.0.1"); IPAddress destination = IPAddress.Parse("127.0.0.1"); string type = GetTopProtocolType(packet, ref source, ref destination); Thread thread = new Thread(() => { string info = string.Format("time:{0}:{1}:{2}/{5} {3} -> {4} type:{6} size:{7}B\n", DateTime.Now.Hour, DateTime.Now.Minute, DateTime.Now.Second, source, destination, DateTime.Now.Millisecond, type, e.Packet.Data.Length); OnAppendPacketInfo(info); lock (packets) { ListViewItem item = new ListViewItem(packets.Count.ToString()); item.SubItems.AddRange(new string[] { source.ToString(), destination.ToString(), e.Packet.Data.Length.ToString(), type }); OnAddListviewItem(item); packets.Add(packet); } }); thread.IsBackground = true; thread.Start(); if (e.Packet.LinkLayerType == LinkLayers.Ethernet) { try { EthernetPacket eth = (EthernetPacket)EthernetPacket.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data); if (eth.PayloadPacket is ARPPacket) { ARPPacket arp = (ARPPacket)eth.PayloadPacket; if (arp.Operation == ARPOperation.Response || arp.Operation == ARPOperation.Request) { if (!macAddress.ContainsKey(arp.SenderProtocolAddress)) { macAddress.Add(arp.SenderProtocolAddress, arp.SenderHardwareAddress); } } } else if (eth.PayloadPacket is IPv4Packet) { IPv4Packet ip = (IPv4Packet)eth.PayloadPacket; if (hadHandledIpList.Contains(ip.Id)) { return; } hadHandledIpList.Add(ip.Id); bool hadSent = false; #region 直连路由包 foreach (Device dev in deviceList) { if (dev.Interface == e.Device) { continue; } if (GetNetIpAddress(ip.DestinationAddress, dev.MaskAddress).ToString() == dev.NetAddress.ToString()) { eth.SourceHwAddress = dev.MacAddress; if (!macAddress.ContainsKey(ip.DestinationAddress)) { MacAddress.GetMacAddress(ip.DestinationAddress); return; } else { eth.DestinationHwAddress = macAddress[ip.DestinationAddress]; } dev.Interface.SendPacket(eth); hadSent = true; } } if (hadSent) { return; } #endregion #region 非直连路由包 RouteTable route = staticRouting[ip.DestinationAddress]; if (route != null) { eth.SourceHwAddress = route.OutInterface.MacAddress; if (!macAddress.ContainsKey(route.NextHop)) { MacAddress.GetMacAddress(route.NextHop); return; } else { eth.DestinationHwAddress = macAddress[route.NextHop]; } route.OutInterface.SendPacket(eth); return; } #endregion } else if (eth.PayloadPacket is PPPoEPacket) { //暂不处理 } } catch { //Protocol of 49185 is not implemented //不支持此协议,对此类协议包进行忽略 return; } } }
void captureDevice_OnPacketArrival(INTERMEDIATE_BUFFER packetBuffer) { //Не люблю вары, пока оставлю так, потом переделаю var packet = EthernetPacket.ParsePacket(LinkLayers.Ethernet, packetBuffer.m_IBuffer); var ethPacket = packet as EthernetPacket; //Автор http://www.theforce.dk/hearthstone/ Описывает как откидывания не нужных пакетов if (packet.PayloadPacket == null || ethPacket.Type != EthernetPacketType.IpV4) { return; } IPv4Packet ipv4Packet = ethPacket.PayloadPacket as IPv4Packet; //А тут видимо отбрасываем если нет содержимого (нужного нам TCP) пакета if (ipv4Packet.PayloadPacket == null) { return; } TcpPacket tcpPacket = ipv4Packet.PayloadPacket as TcpPacket; if (tcpPacket == null) { return; } Connection connection = new Connection(tcpPacket); TcpClient tcpClient; bool connected = false; lock (tcpClients) { connected = tcpClients.TryGetValue(connection, out tcpClient); } //Проводим проверку второго из трёх сообщений для соединения, если такой есть то создаём новый клиент if (tcpPacket.Syn && tcpPacket.Ack && 0 == tcpPacket.PayloadData.Length && !connected) { tcpClient = new TcpClient(flagToDebug); tcpClients.Add(connection, tcpClient); lock (clients) { clients.Add(connection, tcpClient.teraClient); } connected = true; snifferLog("Новое соединение: " + connection.ToString()); if (onNewConnection != null) { onNewConnection(this, new ConnectionEventArgs(connection)); } } if (tcpPacket.Ack && connected) { tcpClient.reConstruction(tcpPacket); } if (tcpPacket.Fin && tcpPacket.Ack && connected) { tcpClients.Remove(connection); lock (clients) { clients[connection].delete = true; existToDelete = true; } snifferLog("Конец соединения: " + connection.ToString()); } }
/* * public EthernetPacketType deNAT_outgoing_packet(ref byte[] data, PhysicalAddress dstMAC, PhysicalAddress srcMAC) * { * EthernetPacketType ethernet_packet_type = getEthernetPacketType(ref data); * if (!isIpOrArpPacket(ethernet_packet_type)) * return ethernet_packet_type; * xbs_nat_entry nat_entry = null; * lock (NAT_list) * { * if (NAT_list.ContainsKey(dstMAC)) * nat_entry = NAT_list[dstMAC]; * } * * if (nat_entry != null) * { * replaceDestinationIpWithOriginalIP(ref data, ethernet_packet_type, ref nat_entry); * updateIPChecksums(ref data); * } * return ethernet_packet_type; * } */ public EthernetPacketType deNAT_outgoing_packet_PacketDotNet(ref byte[] data, PhysicalAddress dstMAC, PhysicalAddress srcMAC) { EthernetPacket p = (EthernetPacket)EthernetPacket.ParsePacket(LinkLayers.Ethernet, data); EthernetPacketType ethernet_packet_type = getEthernetPacketType(ref data); IPv4Packet p_IPV4 = null; ARPPacket p_ARP = null; bool packet_changed = false; if (ethernet_packet_type == EthernetPacketType.IpV4) { p_IPV4 = (IPv4Packet)p.PayloadPacket; } else if (ethernet_packet_type == EthernetPacketType.Arp) { p_ARP = (ARPPacket)p.PayloadPacket; } else { return(ethernet_packet_type); } xbs_nat_entry nat_entry = null; lock (NAT_list) { if (dstMAC.Equals(broadcast_mac)) { if (p_ARP != null) { foreach (xbs_nat_entry ne in NAT_list.Values) { if (ne.natted_source_ip.Equals(p_ARP.TargetProtocolAddress)) { nat_entry = ne; break; } } } } else if (NAT_list.ContainsKey(dstMAC)) { nat_entry = NAT_list[dstMAC]; } } #if DEBUG if (nat_entry != null) { xbs_messages.addDebugMessage("% found device in deNAT list: " + dstMAC + " " + nat_entry.natted_source_ip + "=>" + nat_entry.original_source_ip, xbs_message_sender.NAT); } #endif if (nat_entry != null) { if (p_IPV4 != null) { p_IPV4.DestinationAddress = nat_entry.original_source_ip; p_IPV4.UpdateIPChecksum(); if (p_IPV4.Protocol == IPProtocolType.UDP) { UdpPacket p_UDP = (UdpPacket)p_IPV4.PayloadPacket; if (NAT_enablePS3mode) { bool ret = PS3_replaceClientAnswer_hostAddr(dstMAC, ref p_UDP, nat_entry.original_source_ip, nat_entry.natted_source_ip); } p_UDP.UpdateUDPChecksum(); packet_changed = true; } else if (p_IPV4.Protocol == IPProtocolType.TCP) { ((TcpPacket)p_IPV4.PayloadPacket).UpdateTCPChecksum(); packet_changed = true; } } else if (p_ARP != null) { p_ARP.TargetProtocolAddress = nat_entry.original_source_ip; packet_changed = true; } } if (packet_changed) { data = p.BytesHighPerformance.ActualBytes(); } return((packet_changed) ? ethernet_packet_type : EthernetPacketType.None); }