public static void TimestampHelper_ConvertToByte_Test(bool reorder)
{
byte[] preData = { 1, 0, 0, 0, 1, 0, 0, 0 };
TimestampHelper preTimestamp = new TimestampHelper(preData, false);
byte[] postData = preTimestamp.ConvertToByte(reorder);
TimestampHelper postTimestamp = new TimestampHelper(postData, reorder);
Assert.AreEqual(preTimestamp, postTimestamp);
}
public static void TimestampHelper_Simple_Test()
{
byte[] testData = { 1, 0, 0, 0, 1, 0, 0, 0 };
uint TimestampHight = BitConverter.ToUInt32(testData, 0);
TimestampHelper timestamp = new TimestampHelper(testData, false);
Assert.AreEqual(timestamp.TimestampHight, 1);
Assert.AreEqual(timestamp.TimestampLow, 1);
Assert.AreEqual(timestamp.Seconds, 4294);
Assert.AreEqual(timestamp.Microseconds, 967297);
}
/// <summary>
/// The Packet Block is marked obsolete, better use the Enhanced Packet Block instead!
/// A Packet Block is the standard container for storing the packets coming from the network. The Packet Block is optional because
/// packets can be stored either by means of this block or the Simple Packet Block, which can be used to speed up dump generation.
/// </summary>
public PacketBlock(short InterfaceID, TimestampHelper Timestamp, byte[] Data, int PacketLength, PacketOption Options, long PositionInStream = 0)
{
Contract.Requires<ArgumentNullException>(Timestamp != null, "Timestamp cannot be null");
Contract.Requires<ArgumentNullException>(Options != null, "Options cannot be null");
Contract.Requires<ArgumentNullException>(Data != null, "Data cannot be null");
this.InterfaceID = InterfaceID;
this.Timestamp = Timestamp;
this.PacketLength = PacketLength;
this.Data = Data;
this.options = Options;
this.PositionInStream = PositionInStream;
}
public static PacketBlock Parse(BaseBlock baseBlock, Action<Exception> ActionOnException)
{
Contract.Requires<ArgumentNullException>(baseBlock != null, "BaseBlock cannot be null");
Contract.Requires<ArgumentNullException>(baseBlock.Body != null, "BaseBlock.Body cannot be null");
Contract.Requires<ArgumentException>(baseBlock.BlockType == BaseBlock.Types.Packet, "Invalid packet type");
long positionInStream = baseBlock.PositionInStream;
using (Stream stream = new MemoryStream(baseBlock.Body))
{
using (BinaryReader binaryReader = new BinaryReader(stream))
{
short interfaceID = binaryReader.ReadInt16().ReverseByteOrder(baseBlock.ReverseByteOrder);
short dropCount = binaryReader.ReadInt16().ReverseByteOrder(baseBlock.ReverseByteOrder);
byte[] timestamp = binaryReader.ReadBytes(8);
if (timestamp.Length < 8)
throw new EndOfStreamException("Unable to read beyond the end of the stream");
TimestampHelper timestampHelper = new TimestampHelper(timestamp, baseBlock.ReverseByteOrder);
int capturedLength = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder);
int packetLength = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder);
byte[] data = binaryReader.ReadBytes(capturedLength);
if (data.Length < capturedLength)
throw new EndOfStreamException("Unable to read beyond the end of the stream");
int remainderLength = capturedLength % BaseBlock.AlignmentBoundary;
if (remainderLength > 0)
{
int paddingLength = BaseBlock.AlignmentBoundary - remainderLength;
binaryReader.ReadBytes(paddingLength);
}
PacketOption options = PacketOption.Parse(binaryReader, baseBlock.ReverseByteOrder, ActionOnException);
PacketBlock packetBlock = new PacketBlock(interfaceID, timestampHelper, data, packetLength, options, positionInStream);
return packetBlock;
}
}
}
public InterfaceStatisticsOption(string Comment = null, TimestampHelper StartTime = null, TimestampHelper EndTime = null, long? InterfaceReceived = null,
long? InterfaceDrop = null, long? FilterAccept = null, long? SystemDrop = null, long? DeliveredToUser =null)
{
this.Comment = Comment;
this.StartTime = StartTime;
this.EndTime = EndTime;
this.InterfaceReceived = InterfaceReceived;
this.InterfaceDrop = InterfaceDrop;
this.FilterAccept = FilterAccept;
this.SystemDrop = SystemDrop;
this.DeliveredToUser = DeliveredToUser;
}
/// <summary>
/// The Interface Statistics Block contains the capture statistics for a given interface and it is optional. The statistics are referred
/// to the interface defined in the current Section identified by the Interface ID field. An Interface Statistics Block is normally
/// placed at the end of the file, but no assumptions can be taken about its position - it can even appear multiple times for the same
/// interface.
/// </summary>
public InterfaceStatisticsBlock(int InterfaceID, TimestampHelper Timestamp, InterfaceStatisticsOption Options, long PositionInStream = 0)
{
Contract.Requires<ArgumentNullException>(Timestamp != null, "Timestamp cannot be null");
Contract.Requires<ArgumentNullException>(Options != null, "Options cannot be null");
this.InterfaceID = InterfaceID;
this.Timestamp = Timestamp;
this.options = Options;
this.PositionInStream = PositionInStream;
}
public static InterfaceStatisticsBlock Parse(BaseBlock baseBlock, Action<Exception> ActionOnException)
{
Contract.Requires<ArgumentNullException>(baseBlock != null, "BaseBlock cannot be null");
Contract.Requires<ArgumentNullException>(baseBlock.Body != null, "BaseBlock.Body cannot be null");
Contract.Requires<ArgumentException>(baseBlock.BlockType == BaseBlock.Types.InterfaceStatistics, "Invalid packet type");
long positionInStream = baseBlock.PositionInStream;
using (Stream stream = new MemoryStream(baseBlock.Body))
{
using (BinaryReader binaryReader = new BinaryReader(stream))
{
int interfaceID = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder);
byte[] timestamp = binaryReader.ReadBytes(8);
if (timestamp.Length < 8)
throw new EndOfStreamException("Unable to read beyond the end of the stream");
TimestampHelper timestampHelper = new TimestampHelper(timestamp, baseBlock.ReverseByteOrder);
InterfaceStatisticsOption options = InterfaceStatisticsOption.Parse(binaryReader, baseBlock.ReverseByteOrder, ActionOnException);
InterfaceStatisticsBlock statisticBlock = new InterfaceStatisticsBlock(interfaceID, timestampHelper, options, positionInStream);
return statisticBlock;
}
}
}
public static EnchantedPacketBlock CreateEnchantedPacketFromIPacket(IPacket packet, Action<Exception> ActionOnException)
{
Contract.Requires<ArgumentNullException>(packet != null, "packet cannot be null");
Contract.Requires<ArgumentNullException>(packet.Data != null, "packet.Data cannot be null");
TimestampHelper timestampHelper = new TimestampHelper(packet.Seconds, packet.Microseconds);
EnchantedPacketBlock enchantedBlock = new EnchantedPacketBlock(0, timestampHelper, packet.Data.Length, packet.Data, new EnchantedPacketOption(), 0);
return enchantedBlock;
}
