Exemple #1
0
        public void ReadPackets()
        {
            var pcapPacketReader = this.GetPcapPacketReader("pcap.pcap");

            pcapPacketReader.Header.IsLittleEndian.Should().Be(true);
            pcapPacketReader.Header.MagicNumber.Should().Be(0xA1B2C3D4);
            pcapPacketReader.Header.MajorVersion.Should().Be(2);
            pcapPacketReader.Header.MinorVersion.Should().Be(4);
            pcapPacketReader.Header.MaxCapturedLength.Should().Be(65535);
            pcapPacketReader.Header.DataLinkType.Should().Be(PacketDataLinkType.Ethernet);

            var i = 0;

            foreach (PcapPacket packet in pcapPacketReader.ReadPackets())
            {
                TestOutput.NewLine($"{packet.DataLinkType} {packet.TimestampNanosecond.ToDateTimeOffsetString()}");
                packet.Header.IsLittleEndian.Should().Be(true);
                packet.Header.Header.IsLittleEndian.Should().Be(true);

                if (i == 0)
                {
                    packet.TimestampNanosecond.Should().Be(1_549_110_206_807_127_000UL);
                }
                var ethernetFrame = new EthernetFrame
                {
                    Bytes = packet.Payload
                };
                ethernetFrame.IsLittleEndian.Should().Be(false);
                ethernetFrame.Length.Should().BeGreaterThan(0);
                i++;
            }

            i.Should().Be(27);
        }
Exemple #2
0
        public void dns()
        {
            this.GetPcapPacketReader("dns.pcap").ForEach(octets =>
            {
                var ethernetFrame = (EthernetFrame)octets;

                var ipv4       = (IPv4Packet)ethernetFrame.Payload;
                var udp        = (UDPDatagram)ipv4.Payload;
                var udpPayload = udp.Payload;
                udpPayload.GetType().Should().Be(typeof(DNS));

                TestOutput.NewLine();
                TestOutput.Display(ethernetFrame);
                Assert.True(true);
            });
        }
Exemple #3
0
        public void vxlan()
        {
            this.GetPcapPacketReader("vxlan.pcap").ForEach(bytes =>
            {
                var ethernetFrame = new EthernetFrame {
                    Bytes = bytes
                };

                var ipv4       = (IPv4Packet)ethernetFrame.Payload;
                var udp        = (UDPDatagram)ipv4.Payload;
                var udpPayload = udp.Payload;
                udpPayload.GetType().Should().Be(typeof(VXLAN));

                TestOutput.NewLine();
                TestOutput.Display(ethernetFrame);
            });
        }
Exemple #4
0
        public void ReadBlocks()
        {
            var pcapNGPacketReader = this.GetPcapNGPacketReader("1-shb.11-idb.64-epb.1-nrb.11-isb.pcapng");

            var blocks = pcapNGPacketReader.ReadBlocks().ToList();

            blocks.Count.Should().Be(88);

            var sectionHeaderBlock = (SectionHeaderBlock)blocks[0];

            sectionHeaderBlock.Type.Should().Be(BlockType.SectionHeader);
            sectionHeaderBlock.IsLittleEndian.Should().Be(true);
            sectionHeaderBlock.TotalLength.Should().Be(140);
            sectionHeaderBlock.MagicNumber.Should().Be(0x1A2B3C4DU);
            sectionHeaderBlock.MajorVersion.Should().Be(1);
            sectionHeaderBlock.MinorVersion.Should().Be(0);
            sectionHeaderBlock.SectionLength.Should().Be(4294967295u);

            var interfaceDescriptionBlock = (InterfaceDescriptionBlock)blocks[1];

            interfaceDescriptionBlock.IsLittleEndian.Should().Be(true);
            interfaceDescriptionBlock.Type.Should().Be(BlockType.InterfaceDescription);
            interfaceDescriptionBlock.TotalLength.Should().Be(116);
            interfaceDescriptionBlock.DataLinkType.Should().Be(PacketDataLinkType.Ethernet);
            interfaceDescriptionBlock.MaxCapturedLength.Should().Be(262144u);

            var enhancedPacketBlock = (EnhancedPacketBlock)blocks[12];

            enhancedPacketBlock.InterfaceDescription.Should().BeSameAs(interfaceDescriptionBlock);
            enhancedPacketBlock.IsLittleEndian.Should().Be(true);
            enhancedPacketBlock.Type.Should().Be(BlockType.EnhancedPacket);
            enhancedPacketBlock.TotalLength.Should().Be(212);
            enhancedPacketBlock.InterfaceId.Should().Be(0);
            enhancedPacketBlock.CapturedLength.Should().Be(178);
            enhancedPacketBlock.OriginalLength.Should().Be(178);

            var nameResolutionBlock = (NameResolutionBlock)blocks[76];

            nameResolutionBlock.Type.Should().Be(BlockType.NameResolution);
            nameResolutionBlock.IsLittleEndian.Should().Be(true);
            nameResolutionBlock.TotalLength.Should().Be(216);
            var nameResolutionBlockRecords = nameResolutionBlock.GetRecords().ToList();

            nameResolutionBlockRecords.Count.Should().Be(7);
            var nameResolutionBlockRecord = nameResolutionBlockRecords[0];

            nameResolutionBlockRecord.Type.Should().Be(NameResolutionBlock.RecordType.IPv4);
            nameResolutionBlockRecord.ValueLength.Should().Be(25);
            nameResolutionBlockRecord.IP.ToString().Should().Be("74.125.228.227");
            nameResolutionBlockRecord.Host.Should().Be("clients.l.google.com");

            var interfaceStatisticsBlock = (InterfaceStatisticsBlock)blocks[77];

            interfaceStatisticsBlock.InterfaceDescription.Should().BeSameAs(interfaceDescriptionBlock);
            interfaceStatisticsBlock.Should().NotBeAssignableTo <IPacket>();
            interfaceStatisticsBlock.IsPacket.Should().Be(false);
            interfaceStatisticsBlock.TotalLength.Should().Be(0x6c);
            interfaceStatisticsBlock.InterfaceId.Should().Be(0);

            foreach (var block in blocks)
            {
                block.SectionHeader.Should().BeSameAs(sectionHeaderBlock);
                if (block.Type == BlockType.InterfaceStatistics)
                {
                    var interfaceStatistics = (InterfaceStatisticsBlock)block;
                    TestOutput.NewLine($"{interfaceStatistics.InterfaceId} {interfaceStatistics.TimestampNanosecond.ToDateTimeOffsetString()}");
                }
                if (block.IsPacket == false)
                {
                    continue;
                }

                var packet = block as IPacket;
                TestOutput.NewLine($"{packet.DataLinkType} {packet.TimestampNanosecond.ToDateTimeOffsetString()}");
                if (packet.DataLinkType != PacketDataLinkType.Ethernet)
                {
                    continue;
                }
                var ethernetFrame = new EthernetFrame
                {
                    Bytes = packet.Payload
                };

                TestOutput.NewLine();
                TestOutput.Display(ethernetFrame);
            }
        }