public static void Test_DumpPacketsToFile_04(string dumpFile, string deviceName = null, bool detail = false, string filter = null)
{
Trace.WriteLine("Test_DumpPacketsToFile_04");
Trace.WriteLine("dump to file \"{0}\"", dumpFile);
//string filter = "not tcp portrange 52000-53000 and not net 0.0.0.0 mask 255.0.0.0";
ReceivePackets receivePackets = CreateReceivePackets(deviceName, dumpFile, filter);
receivePackets.Receive(PrintIpAdressList);
}
public static void Test_AnalyzeTcpStreamTest_01(string deviceName)
{
Trace.WriteLine("Test_AnalyzeTcpStreamTest_01");
ReceivePackets receivePackets = CreateReceivePackets(deviceName);
Pib.Pcap.Test.AnalyzeTcpStreamTest tcpAnalyze = new Pib.Pcap.Test.AnalyzeTcpStreamTest();
receivePackets.Receive(packet => tcpAnalyze.Add(packet));
Trace.WriteLine("{0} packet captured", tcpAnalyze.Packets.Count);
var q = from p in tcpAnalyze.Packets where p.PPacket.Tcp != null orderby p.StreamNumber, p.PPacket.PacketNumber select p;
Trace.WriteLine("{0} packet selectionned", q.Count());
foreach (Pib.Pcap.Test.TcpStreamPacket p in q)
{
PrintStreamPacket(p);
}
}
public static void Test_SortedTcpStreamList_01(string deviceName)
{
SortedTcpStreamList sortedTcpStreamList = new SortedTcpStreamList();
ReceivePackets receivePackets = CreateReceivePackets(deviceName);
receivePackets.Receive(sortedTcpStreamList.Add);
Trace.WriteLine("{0} packet captured", sortedTcpStreamList.TotalPacketsCount);
Trace.WriteLine("{0} packet selectionned", sortedTcpStreamList.SelectionnedPacketsCount);
//var q = from p in tcpAnalyze.Packets where p.PPacket.Tcp != null orderby p.StreamNumber, p.PPacket.PacketNumber select p;
//var q = from p in sortedTcpStreamList.TcpStreamPacketsList from p2 in p.Value orderby p.Key.Index, p2.PacketNumber select new { TcpConnection = p.Key, PPacket = p2 };
var q = from ppacketList in sortedTcpStreamList.TcpStreamPacketsList.Values from ppacket in ppacketList orderby ppacket.GetTcpConnection().Index, ppacket.PacketNumber select ppacket;
foreach (PPacket ppacket in q)
{
//PrintSortedTcpStreamPacket(p.TcpConnection, p.PPacket);
PrintSortedTcpStreamPacket(ppacket);
}
}
public static ReceivePackets CreateReceivePackets(string deviceName, string dumpFile = null, string filter = null)
{
if (deviceName == null)
{
deviceName = @"rpcap://\Device\NPF_{BF8A52CB-F023-4F24-AA7E-958A8D1F3069}";
}
Trace.WriteLine("select device \"{0}\"", deviceName);
if (!deviceName.StartsWith("rpcap://"))
{
deviceName = GetPath(deviceName);
}
if (dumpFile != null)
{
Trace.WriteLine("dump to file \"{0}\"", dumpFile);
dumpFile = GetPath(dumpFile);
}
ReceivePackets receivePackets = ReceivePackets.CreateReceivePackets(deviceName, dumpFile, filter);
_rs.OnAbortExecution = receivePackets.Break;
return(receivePackets);
}
public static void Test_PrintPacketsDetail_02(string deviceName = null)
{
Trace.WriteLine("Test_PrintPacketsDetail_02");
ReceivePackets receivePackets = CreateReceivePackets(deviceName);
//receivePackets.Receive(PrintPacketDetail.PrintPacketDetailHandler, 5);
//receivePackets.Receive(PrintPacketDetail.PrintPacketDetailHandler);
int i = 0;
receivePackets.Receive(ppacket =>
{
IpV4Datagram ip = ppacket.Packet.Ethernet.IpV4;
if (ip.Tcp == null || ip.Tcp.Http.Version == null)
{
return;
}
if (++i > 5)
{
return;
}
PrintPacketDetail.PrintPacketDetailHandler(ppacket);
});
}
