private void InfoAndEmit(IContext ctx, ArpPacket request, ArpPacket reply)
{
ctx.Warn($"Gratuitous ARP packet {request} has got answer {reply}. Possible problems in IP address assignement.");
ctx.TryInsert(new ArpGratuitous {
Request = request, Reply = reply
});
}
public override void Define()
{
ArpPacket packet = null;
When()
.Match(() => packet, x => BadPadding(x));
Then()
.Do(ctx => ctx.Warn($"ARP packet {packet} has bad padding."));
}
private void InfoAndEmit(IContext ctx, ArpPacket arp)
{
var mapping = new ArpAddressMapping {
EthAddr = arp.ArpSrcHwMac, IpAddr = arp.ArpSrcProtoIpv4
};
ctx.Info($"ARP mapping: {mapping}");
ctx.TryInsert(mapping);
}
public override void Define()
{
ArpPacket arp = null;
When()
.Match(() => arp);
Then()
.Do(ctx => InfoAndEmit(ctx, arp));
}
public override void Define()
{
ArpPacket request = null;
ArpPacket reply = null;
When()
.Match(() => request, x => x.Opcode == ArpOpcode.Request && x.IsGratuitous)
.Match(() => reply, x => x.Opcode == ArpOpcode.Reply, x => x.EthDst == request.EthSrc, x => x.FrameTimeRelative - request.FrameTimeRelative < 1);
Then()
.Do(ctx => InfoAndEmit(ctx, request, reply)); //
}
public override void Define()
{
ArpPacket request = null;
When()
.Match <ArpPacket>(() => request, x => x.Opcode == ArpOpcode.Request && !x.IsGratuitous)
.Not <ArpPacket>(x => x.Opcode == ArpOpcode.Reply, x => x.EthDst == request.EthSrc, x => x.FrameTimeRelative - request.FrameTimeRelative < 1);
Then()
.Do(ctx => ctx.TryInsert(new ArpUnanswered {
Request = request
}));
}
public static ArpPacket Create(System.Func <string, string, string> mapper, string[] values)
{
ArpPacket newObj = new ArpPacket();
newObj._FrameNumber = mapper.Invoke("frame.number", values[0]).ToInt32();
newObj._FrameTimeRelative = mapper.Invoke("frame.time_relative", values[1]).ToDouble();
newObj._EthSrc = mapper.Invoke("eth.src", values[2]).ToString();
newObj._EthDst = mapper.Invoke("eth.dst", values[3]).ToString();
newObj._ArpOpcode = mapper.Invoke("arp.opcode", values[4]).ToInt32();
newObj._ArpSrcHwMac = mapper.Invoke("arp.src.hw_mac", values[5]).ToString();
newObj._ArpDstHwMac = mapper.Invoke("arp.dst.hw_mac", values[6]).ToString();
newObj._ArpSrcProtoIpv4 = mapper.Invoke("arp.src.proto_ipv4", values[7]).ToString();
newObj._ArpDstProtoIpv4 = mapper.Invoke("arp.dst.proto_ipv4", values[8]).ToString();
newObj._EthPadding = mapper.Invoke("eth.padding", values[9]).ToString();
return(newObj);
}
public override bool Equals(object obj)
{
ArpPacket that = obj as ArpPacket;
return(((((((((((that != null) &&
object.Equals(this.FrameNumber, that.FrameNumber)) &&
object.Equals(this.FrameTimeRelative, that.FrameTimeRelative)) &&
object.Equals(this.EthSrc, that.EthSrc)) &&
object.Equals(this.EthDst, that.EthDst)) &&
object.Equals(this.ArpOpcode, that.ArpOpcode)) &&
object.Equals(this.ArpSrcHwMac, that.ArpSrcHwMac)) &&
object.Equals(this.ArpDstHwMac, that.ArpDstHwMac)) &&
object.Equals(this.ArpSrcProtoIpv4, that.ArpSrcProtoIpv4)) &&
object.Equals(this.ArpDstProtoIpv4, that.ArpDstProtoIpv4)) &&
object.Equals(this.EthPadding, that.EthPadding));
}
private bool BadPadding(ArpPacket packet)
{
return(packet.EthPadding.Any(x => !(x == '0' || x == ':')));
}
