public static PCAPNGFileHeader CreateFromReader(BinaryReader rdrFrom, uint uiMagic)
        {
            PCAPNGFileHeader pCAPNGFileHeader = new PCAPNGFileHeader();

            pCAPNGFileHeader.MagicNumber         = uiMagic;
            pCAPNGFileHeader.SectionHeaderLength = rdrFrom.ReadUInt32();
            pCAPNGFileHeader.ByteOrderMagic      = rdrFrom.ReadUInt32();
            pCAPNGFileHeader.VerMajor            = rdrFrom.ReadUInt16();
            pCAPNGFileHeader.VerMinor            = rdrFrom.ReadUInt16();
            pCAPNGFileHeader.longSectionLength   = rdrFrom.ReadInt64();
            uint count = pCAPNGFileHeader.SectionHeaderLength - 28u;

            rdrFrom.ReadBytes((int)count);
            pCAPNGFileHeader.RepeatedHeaderLength = rdrFrom.ReadUInt32();
            return(pCAPNGFileHeader);
        }
Exemple #2
0
        private Session[] GetSessionsFromPCAPNG(BinaryReader rdr, uint uiMagic)
        {
            PCAPNGFileHeader pCAPNGFileHeader = PCAPNGFileHeader.CreateFromReader(rdr, uiMagic);

            if (pCAPNGFileHeader.ByteOrderMagic != 439041101u)
            {
                Console.WriteLine(String.Format("Sorry, this format is not yet supported. Please contact support.", "Unsupported Byte-Order"));
                return(null);
            }
            if (pCAPNGFileHeader.SectionHeaderLength != pCAPNGFileHeader.RepeatedHeaderLength)
            {
                Console.WriteLine(String.Format("Sorry, this file appears to be corrupt. HeaderLength != TrailingHeaderLength. Please contact support.", "File Corrupt"));
                return(null);
            }
            //Console.WriteLine(String.Format("Importing PCAPNG:\n{0}", pCAPNGFileHeader);

            PacketCaptureImport.PacketCounts  packetCounts = default(PacketCaptureImport.PacketCounts);
            Dictionary <uint, DNSTransaction> dictionary   = new Dictionary <uint, DNSTransaction>();
            Dictionary <string, TCPStream>    dictionary2  = new Dictionary <string, TCPStream>();
            long length = rdr.BaseStream.Length;
            bool flag   = false;

            while (!flag && rdr.BaseStream.Position + 8L <= length)
            {
                PCAPNGBlockHeader pCAPNGBlockHeader = PCAPNGBlockHeader.CreateFromReader(rdr);
                PCAPNGBlockType   uiBlockType       = pCAPNGBlockHeader.uiBlockType;
                if (uiBlockType != PCAPNGBlockType.InterfaceDescriptionBlock)
                {
                    if (uiBlockType != PCAPNGBlockType.EnhancedPacketBlock)
                    {
                        //FiddlerApplication.get_Log().LogString(pCAPNGBlockHeader.ToString());
                        rdr.ReadBytes((int)(pCAPNGBlockHeader.uiBlockLength - 8u));
                    }
                    else
                    {
                        packetCounts.Total += 1u;
                        PCAPNGEnhancedPacketHeader pCAPNGEnhancedPacketHeader = PCAPNGEnhancedPacketHeader.CreateFromReader(rdr);
                        if (pCAPNGEnhancedPacketHeader.PacketOriginalSize != pCAPNGEnhancedPacketHeader.PacketSavedSize)
                        {
                            //FiddlerApplication.get_Log().LogFormat("! WARNING: Packet was not stored completely. Stored only {0}/{1} bytes", new object[]
                            //{
                            //    pCAPNGEnhancedPacketHeader.PacketSavedSize,
                            //    pCAPNGEnhancedPacketHeader.PacketOriginalSize
                            //});
                        }
                        byte[] array = rdr.ReadBytes((int)pCAPNGEnhancedPacketHeader.PacketSavedSize);
                        if ((long)array.Length != (long)((ulong)pCAPNGEnhancedPacketHeader.PacketSavedSize))
                        {
                            //FiddlerApplication.get_Log().LogFormat("! WARNING: File was incomplete. Last frame stored only {0}/{1} bytes", new object[]
                            //{
                            //    array.Length,
                            //    pCAPNGEnhancedPacketHeader.PacketSavedSize
                            //});
                            flag = true;
                        }
                        else
                        {
                            IPFrame iPFrame = IPFrame.ParseAsIPFrame(packetCounts.Total, array, pCAPNGEnhancedPacketHeader.dtPacket);
                            if (iPFrame == null)
                            {
                                rdr.ReadBytes((int)((ulong)(pCAPNGBlockHeader.uiBlockLength - 28u) - (ulong)((long)pCAPNGEnhancedPacketHeader.PacketSavedSize)));
                            }
                            else
                            {
                                if (iPFrame.IPVersion == 4)
                                {
                                    packetCounts.IPv4 += 1u;
                                }
                                else
                                {
                                    if (iPFrame.IPVersion == 6)
                                    {
                                        packetCounts.IPv6 += 1u;
                                    }
                                }
                                IPSubProtocols nextProtocol = iPFrame.NextProtocol;
                                if (nextProtocol != IPSubProtocols.TCP)
                                {
                                    if (nextProtocol != IPSubProtocols.UDP)
                                    {
                                        if (nextProtocol == IPSubProtocols.ESP)
                                        {
                                            if (PacketCaptureImport.bVerboseDebug)
                                            {
                                                //FiddlerApplication.get_Log().LogFormat("ESP Frame #{0} skipped; parsing NYI", new object[]
                                                //{
                                                //    iPFrame.iFrameNumber
                                                //});
                                            }
                                        }
                                    }
                                    else
                                    {
                                        UDPMessage uDPMessage = UDPMessage.Parse(iPFrame, array);
                                        packetCounts.UDP += 1u;
                                        if (WellKnownPorts.DNS == uDPMessage.DstPort)
                                        {
                                            DNSQuery dNSQuery = DNSQuery.Parse(iPFrame, array);
                                            if (dNSQuery.QueryType == DNSQueryType.AddressQuery)
                                            {
                                                DNSTransaction dNSTransaction;
                                                if (!dictionary.TryGetValue(dNSQuery.uiTransactionID, out dNSTransaction))
                                                {
                                                    dNSTransaction = new DNSTransaction();
                                                    dictionary.Add(dNSQuery.uiTransactionID, dNSTransaction);
                                                }
                                                dNSTransaction.uiTransactionID   = dNSQuery.uiTransactionID;
                                                dNSTransaction.sQueryForHostname = dNSQuery.sHostname;
                                                dNSTransaction.bAAAAQuery        = (dNSQuery.QueryType == DNSQueryType.AAAA);
                                                dNSTransaction.dtQuerySent       = pCAPNGEnhancedPacketHeader.dtPacket;
                                            }
                                        }
                                        else
                                        {
                                            if (WellKnownPorts.DNS == uDPMessage.SrcPort)
                                            {
                                                DNSResponse    dNSResponse = DNSResponse.Parse(iPFrame, array);
                                                DNSTransaction dNSTransaction2;
                                                if (dictionary.TryGetValue(dNSResponse.uiTransactionID, out dNSTransaction2))
                                                {
                                                    dNSTransaction2.dtResponseReceived = pCAPNGEnhancedPacketHeader.dtPacket;
                                                }
                                            }
                                        }
                                    }
                                }
                                else
                                {
                                    TCPFrame tCPFrame = TCPFrame.Parse(iPFrame, array);
                                    if (tCPFrame == null)
                                    {
                                        continue;
                                    }
                                    packetCounts.TCP += 1u;
                                    TCPEndpoints tCPEndpoints = new TCPEndpoints(iPFrame.ipSrc, iPFrame.ipDest, tCPFrame.SrcPort, tCPFrame.DstPort);
                                    string       key          = tCPEndpoints.ToString();
                                    TCPStream    tCPStream;
                                    if (!dictionary2.TryGetValue(key, out tCPStream))
                                    {
                                        tCPStream = new TCPStream(tCPEndpoints);
                                        dictionary2.Add(key, tCPStream);
                                    }
                                    tCPStream.AddFrame(tCPFrame);
                                }
                                int count = (int)((ulong)(pCAPNGBlockHeader.uiBlockLength - 28u) - (ulong)((long)pCAPNGEnhancedPacketHeader.PacketSavedSize));
                                rdr.ReadBytes(count);
                            }
                        }
                    }
                }
                else
                {
                    //FiddlerApplication.get_Log().LogString(pCAPNGBlockHeader.ToString());
                    rdr.ReadBytes((int)(pCAPNGBlockHeader.uiBlockLength - 8u));
                }
            }
            return(this.GetSessionsFromPackets(ref packetCounts, dictionary2));
        }