public void Add(PPacket ppacket)
{
_totalPacketsCount++;
if (ppacket.Tcp == null)
{
return;
}
_selectionnedPacketsCount++;
//IndexedTcpConnection tcpConnection = new IndexedTcpConnection(ppacket.Packet);
TcpConnection tcpConnection = ppacket.GetTcpConnection();
int i = _tcpStreamPacketsList.IndexOfKey(tcpConnection);
List <PPacket> ppacketList;
if (i == -1)
{
tcpConnection.Index = ++_tcpConnectionIndex;
ppacketList = new List <PPacket>();
_tcpStreamPacketsList.Add(tcpConnection, ppacketList);
}
else
{
tcpConnection.Index = _tcpStreamPacketsList.Keys[i].Index;
ppacketList = _tcpStreamPacketsList.Values[i];
}
ppacketList.Add(ppacket);
}
private void PrintIpV4(PPacket ppacket)
{
//EthernetDatagram ethernet = ppacket.Packet.Ethernet;
IpV4Datagram ip = ppacket.Packet.Ethernet.IpV4;
//if (ethernet.EtherType != EthernetType.IpV4)
// return;
_dataLength -= (ushort)ip.HeaderLength;
WriteTitle("[ipv4 frame]");
WriteValues(1, "version", ip.Version, "header length", ip.HeaderLength);
//WriteValues(0, "internet header length (ihl)", ip.HeaderLength / 4, "data length", _dataLength);
WriteValues(0, "internet header length (ihl)", ip.HeaderLength / 4);
WriteValues(1, "dscp", "0x" + ip.TypeOfService.zToHex());
WriteValues(0, "ecn");
WriteValues(2, "total length", ip.TotalLength);
WriteValues(2, "identification", "0x" + ip.Identification.zToHex());
WriteValues(2, "flags");
WriteValues(0, "fragment offset", "0x" + ip.Fragmentation.Offset.zToHex());
WriteValues(1, "time to live", "0x" + ip.Ttl.zToHex());
WriteValues(1, "protocol", "0x" + ((byte)ip.Protocol).zToHex() + " " + ppacket.IpProtocolCode);
WriteValues(2, "header checksum", "0x" + ip.HeaderChecksum.zToHex());
WriteValues(4, "source ip address", ip.Source);
WriteValues(4, "destination ip address", ip.Destination);
WriteValues(ip.HeaderLength - 20, "options (if ihl > 5)");
WriteTitle("[ipv4 data]");
WritePayloadData(48, ip.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
}
//private int _packetIndex = 1;
private void PacketHandle(PPacket ppacket)
{
//if (ppacket.Packet.Ethernet == null || ppacket.Packet.Ethernet.IpV4 == null || ppacket.Packet.Ethernet.IpV4.Tcp == null)
if (ppacket.Ipv4 == null || ppacket.Tcp == null)
return;
//TcpStreamPacket tcpStreamPacket = new TcpStreamPacket(packet);
//TcpConnection tcpConnection = tcpStreamPacket.Connection;
//TcpConnection tcpConnection = new TcpConnection(ppacket.Packet);
TcpConnection tcpConnection = ppacket.GetTcpConnection();
if (!_tcpStreamList.ContainsKey(tcpConnection))
{
TcpStream tcpStream = new TcpStream(tcpConnection);
_tcpStreamList.Add(tcpConnection, tcpStream);
//WriteTcpStreamToFile writeTcpStreamToFile = new WriteTcpStreamToFile(tcpStream, _directory);
//_tcpStreamToFileList.Add(writeTcpStreamToFile);
//new CreatePacketTcpStream(tcpStream).TcpPacketHandle = (direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); };
//if (_trace)
// new TraceTcpStream(tcpStream);
tcpStream.zWriteTcpStreamToFile(_directory);
//tcpStream.CreatePacketTcpStream((direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); });
tcpStream.zTcpStreamReassembledPacket((direction, tcpPacket) => { PrintPacket.PrintPacket1(_ppacketManager.CreatePPacket(tcpPacket), true); });
if (_trace)
tcpStream.zTraceTcpStream(_directory);
}
//Trace.CurrentTrace.WriteLine("packet no {0} {1}:{2} - {3}:{4}", _packetIndex++, tcpConnection.Source.Address, tcpConnection.Source.Port, tcpConnection.Destination.Address, tcpConnection.Destination.Port);
//_tcpStreamList[tcpConnection].Add(tcpStreamPacket);
//_tcpStreamList[tcpConnection].Add(tcpConnection, ppacket);
_tcpStreamList[tcpConnection].Add(ppacket);
}
private void PrintHttp(PPacket ppacket)
{
HttpDatagram http = ppacket.Packet.Ethernet.IpV4.Tcp.Http;
//ReadOnlyCollection<HttpDatagram> httpCollection = ppacket.Packet.Ethernet.IpV4.Tcp.HttpCollection;
WriteTitle("[http]");
WriteValues(0, "version", http.Version != null ? http.Version.ToString() : "null");
WriteValues(0, "is request", http.IsRequest);
WriteValues(0, "is response", http.IsResponse);
WriteValues(0, "header", http.Header != null ? http.Header.ToString() : "null");
}
//public void Add(TcpStreamPacket tcpStreamPacket)
//public void Add(TcpConnection tcpConnection, PPacket ppacket)
public void Add(PPacket ppacket)
{
TcpConnection tcpConnection = ppacket.GetTcpConnection();
if (tcpConnection.Source == _tcpConnection.Source && tcpConnection.Destination == _tcpConnection.Destination)
{
_streamSourceToDestination.Add(ppacket);
}
else
{
_streamDestinationToSource.Add(ppacket);
}
}
private void PrintEthernet(PPacket ppacket)
{
EthernetDatagram ethernet = ppacket.Packet.Ethernet;
if (ethernet == null)
return;
_dataLength -= 14;
WriteTitle("[ethernet frame]");
WriteValues(6, "destination MAC address", ethernet.Destination, "header length", 14);
//WriteValues(6, "source MAC address", ethernet.Source, "data length", _dataLength);
WriteValues(6, "source MAC address", ethernet.Source);
WriteValues(2, "ether type", "0x" + ((ushort)ethernet.EtherType).zToHex() + " " + ppacket.EthernetTypeCode);
WriteTitle("[ethernet data]");
WritePayloadData(48, ethernet.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
}
public static void PrintPacket1(PPacket ppacket, bool detail = false, ITrace trace = null)
{
if (trace == null)
{
trace = Trace.CurrentTrace;
}
//************* 0 3 0.465083 192.168.0.1 52581 173.194.66.94 443 TCP ACK 0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A .
//_tr.WriteLine("group no time source port destination port protocal flags length sequence next seq ack number window urgent");
StringBuilder sb = new StringBuilder();
//_tr.Write("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
sb.AppendFormat("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.IpProtocolCode);
if (detail)
{
TcpDatagram tcp = ppacket.Tcp;
if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
{
sb.AppendFormat(" {0,-20}", ppacket.GetTcpFlagsString());
sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);
sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);
int i = 0;
int maxDataChar = 50;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
{
break;
}
if (b >= 32 && b <= 126)
{
sb.Append(((char)b).ToString());
}
else
{
sb.Append(".");
}
}
}
else if (ppacket.Packet.Ethernet == null)
{
sb.Append(" not ethernet");
}
}
trace.WriteLine(sb.ToString());
}
private void writeData(byte[] data, PPacket ppacket, string message)
{
// ignore empty packets
if (data.Length == 0)
{
return;
}
if (WriteData != null)
{
WriteData(data, new TcpStreamWriteDataInfo()
{
PPacket = ppacket, Message = message, NextSequenceNumber = _sequenceNumber
});
}
_bytesWritten += (uint)data.Length;
_emptyTcpStream = false;
}
public static void PrintPacket1(PPacket ppacket, bool detail = false, ITrace trace = null)
{
if (trace == null)
trace = Trace.CurrentTrace;
//************* 0 3 0.465083 192.168.0.1 52581 173.194.66.94 443 TCP ACK 0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A .
//_tr.WriteLine("group no time source port destination port protocal flags length sequence next seq ack number window urgent");
StringBuilder sb = new StringBuilder();
//_tr.Write("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
sb.AppendFormat("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.IpProtocolCode);
if (detail)
{
TcpDatagram tcp = ppacket.Tcp;
if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
{
sb.AppendFormat(" {0,-20}", ppacket.GetTcpFlagsString());
sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);
sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);
int i = 0;
int maxDataChar = 50;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
break;
if (b >= 32 && b <= 126)
sb.Append(((char)b).ToString());
else
sb.Append(".");
}
}
else if (ppacket.Packet.Ethernet == null)
sb.Append(" not ethernet");
}
trace.WriteLine(sb.ToString());
}
private void PrintTcp(PPacket ppacket)
{
//IpV4Datagram ip = ppacket.Packet.Ethernet.IpV4;
TcpDatagram tcp = ppacket.Packet.Ethernet.IpV4.Tcp;
//if (ip.Protocol != IpV4Protocol.Tcp)
// return;
_dataLength -= (ushort)tcp.RealHeaderLength;
WriteTitle("[tcp frame]");
WriteValues(2, "source port", tcp.SourcePort, "header length", tcp.RealHeaderLength);
//WriteValues(2, "destination port", tcp.DestinationPort, "data length", _dataLength);
WriteValues(2, "destination port", tcp.DestinationPort);
WriteValues(4, "sequence number", "0x" + tcp.SequenceNumber.zToHex());
WriteValues(4, "acknowledgment number", "0x" + tcp.AcknowledgmentNumber.zToHex());
WriteValues(2, "data offset", "0x" + ((byte)tcp.HeaderLength).zToHex());
WriteValues(0, "ecn", tcp.IsExplicitCongestionNotificationEcho);
WriteValues(0, "cwr", tcp.IsCongestionWindowReduced);
WriteValues(0, "ece", tcp.IsExplicitCongestionNotificationEcho);
WriteValues(0, "urg", tcp.IsUrgent);
WriteValues(0, "ack", tcp.IsAcknowledgment);
WriteValues(0, "psh", tcp.IsPush);
WriteValues(0, "rst", tcp.IsReset);
WriteValues(0, "syn", tcp.IsSynchronize);
WriteValues(0, "fin", tcp.IsFin);
WriteValues(2, "window size", "0x" + tcp.Window.zToHex());
WriteValues(2, "checksum", "0x" + tcp.Checksum.zToHex());
WriteValues(2, "urgent pointer", "0x" + tcp.UrgentPointer.zToHex());
int optionLength = tcp.RealHeaderLength - 20;
int n = Math.Min(8, optionLength);
WriteValues(n, "options", null, "options length", optionLength);
optionLength -= n;
while (optionLength > 0)
{
n = Math.Min(8, optionLength);
WriteValues(n);
optionLength -= n;
}
WriteTitle("[tcp data]");
WritePayloadData(48, tcp.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
}
//private static void PrintSortedTcpStreamPacket(IndexedTcpConnection tcpConnection, PPacket ppacket)
private static void PrintSortedTcpStreamPacket(PPacket ppacket)
{
TcpConnection tcpConnection = ppacket.GetTcpConnection();
if (_currentTcpConnection == null || tcpConnection.Index != _currentTcpConnection.Index)
{
Trace.WriteLine();
Trace.WriteLine("group packet time source dir destination protocol flags data seq next seq ack window urg data");
//_LastStreamNumber = tcpConnection.Index;
_currentTcpConnection = tcpConnection;
}
//TcpDirection direction = TcpDirection.SourceToDestination;
//string s = GetTcpStreamPacketString1(tcpConnection, ppacket, _currentTcpConnection.GetTcpDirection(tcpConnection), true);
string s = GetTcpStreamPacketString1(ppacket, _currentTcpConnection.GetTcpDirection(tcpConnection), true);
//string s2 = null;
//foreach (Pib.Pcap.Test.TcpPacketError error in streamPacket.Errors)
// s2 = s2.zAddValue(streamPacket.GetErrorMessage(error));
//if (s2 != null)
// s2 = " " + s2;
//Trace.WriteLine("{0,-162}{1}{2}", s, ppacket.GetTcpDescription(), s2);
Trace.WriteLine(s);
}
public void Add(PPacket ppacket)
{
_totalPacketsCount++;
if (ppacket.Tcp == null)
return;
_selectionnedPacketsCount++;
//IndexedTcpConnection tcpConnection = new IndexedTcpConnection(ppacket.Packet);
TcpConnection tcpConnection = ppacket.GetTcpConnection();
int i = _tcpStreamPacketsList.IndexOfKey(tcpConnection);
List<PPacket> ppacketList;
if (i == -1)
{
tcpConnection.Index = ++_tcpConnectionIndex;
ppacketList = new List<PPacket>();
_tcpStreamPacketsList.Add(tcpConnection, ppacketList);
}
else
{
tcpConnection.Index = _tcpStreamPacketsList.Keys[i].Index;
ppacketList = _tcpStreamPacketsList.Values[i];
}
ppacketList.Add(ppacket);
}
//private int _packetIndex = 1;
private void PacketHandle(PPacket ppacket)
{
//if (ppacket.Packet.Ethernet == null || ppacket.Packet.Ethernet.IpV4 == null || ppacket.Packet.Ethernet.IpV4.Tcp == null)
if (ppacket.Ipv4 == null || ppacket.Tcp == null)
{
return;
}
//TcpStreamPacket tcpStreamPacket = new TcpStreamPacket(packet);
//TcpConnection tcpConnection = tcpStreamPacket.Connection;
//TcpConnection tcpConnection = new TcpConnection(ppacket.Packet);
TcpConnection tcpConnection = ppacket.GetTcpConnection();
if (!_tcpStreamList.ContainsKey(tcpConnection))
{
TcpStream tcpStream = new TcpStream(tcpConnection);
_tcpStreamList.Add(tcpConnection, tcpStream);
//WriteTcpStreamToFile writeTcpStreamToFile = new WriteTcpStreamToFile(tcpStream, _directory);
//_tcpStreamToFileList.Add(writeTcpStreamToFile);
//new CreatePacketTcpStream(tcpStream).TcpPacketHandle = (direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); };
//if (_trace)
// new TraceTcpStream(tcpStream);
tcpStream.zWriteTcpStreamToFile(_directory);
//tcpStream.CreatePacketTcpStream((direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); });
tcpStream.zTcpStreamReassembledPacket((direction, tcpPacket) => { PrintPacket.PrintPacket1(_ppacketManager.CreatePPacket(tcpPacket), true); });
if (_trace)
{
tcpStream.zTraceTcpStream(_directory);
}
}
//Trace.CurrentTrace.WriteLine("packet no {0} {1}:{2} - {3}:{4}", _packetIndex++, tcpConnection.Source.Address, tcpConnection.Source.Port, tcpConnection.Destination.Address, tcpConnection.Destination.Port);
//_tcpStreamList[tcpConnection].Add(tcpStreamPacket);
//_tcpStreamList[tcpConnection].Add(tcpConnection, ppacket);
_tcpStreamList[tcpConnection].Add(ppacket);
}
private static void PrintPacketDetailHandlerOld(PPacket ppacket)
{
EthernetDatagram ethernet = ppacket.Packet.Ethernet;
if (ethernet == null)
{
_tr.WriteLine("---------------------------------------------[not ethernet packet]---------------------------------------------");
_tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
_tr.WriteLine();
return;
}
_tr.WriteLine("----------------------------------[ethernet type II frame (64 to 1518 bytes)]----------------------------------");
_tr.WriteLine("| dest MAC address src MAC address ether type data (46-1500 bytes) length CRC checksum total length |");
_tr.WriteLine("| XX:XX:XX:XX:XX:XX XX:XX:XX:XX:XX:XX XX XX XX XX XX XX XX XX ... XX XX XX XX |");
_tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
StringBuilder sb = new StringBuilder();
sb.Append("|");
byte[] buffer = ppacket.Packet.Buffer;
int i = 0;
foreach (byte b in buffer)
{
if (i == 6 || i == 12)
sb.Append(" ");
else if (i == 14)
sb.Append(" ");
else if (i == 20)
{
sb.Append(" ... ");
sb.AppendFormat(" {0,6} ", ethernet.PayloadLength);
break;
}
sb.Append(" ");
sb.Append(b.zToHex());
i++;
}
//for (i = buffer.Length - 4; i < buffer.Length; i++)
//{
// byte b = buffer[i];
// sb.Append(" ");
// sb.Append(b.zToHex());
//}
sb.Append(" ");
// total length
sb.AppendFormat(" {0,6} |", ppacket.Packet.Count);
_tr.WriteLine(sb.ToString());
_tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
sb.Clear();
sb.AppendFormat("| {0} {1} {2} ", ethernet.Destination, ethernet.Source, ((ushort)ethernet.EtherType).zToHex());
i = 0;
foreach (byte b in ethernet.Payload)
{
if (i++ == 6)
break;
sb.Append(" ");
sb.Append(b.zToHex());
}
sb.Append(" ... ");
sb.AppendFormat(" {0,6} ", ethernet.PayloadLength);
if (ethernet.FrameCheckSequence != null)
{
foreach (byte b in ethernet.FrameCheckSequence)
{
sb.Append(" ");
sb.Append(b.zToHex());
}
}
else
sb.Append(" ");
sb.AppendFormat(" {0,6} |", ppacket.Packet.Count);
_tr.WriteLine(sb.ToString());
_tr.WriteLine("| {0,-25} |", ppacket.EthernetTypeCode);
_tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
IpV4Datagram ip = ethernet.IpV4;
if (ip == null)
{
_tr.WriteLine("-----------------------------------------------[not ipv4 packet]-----------------------------------------------");
_tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
_tr.WriteLine();
return;
}
buffer = ip.ToArray();
_tr.WriteLine("------------------------------------------[ipv4 header]-------------------------------------------");
_tr.WriteLine("| 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |");
_tr.WriteLine("| version | ihl | dscp | ecn | total length |");
_tr.WriteLine("| identification | flags | fragment offset |");
_tr.WriteLine("| time to live | protocol | header checksum |");
_tr.WriteLine("| source ip address |");
_tr.WriteLine("| destination ip address |");
_tr.WriteLine("| options (if ihl > 5) |");
_tr.WriteLine("--------------------------------------------------------------------------------------------------");
sb.Clear();
for (i = 0; i < 4; i++)
sb.AppendFormat("| {0} ", buffer[i].zToHex());
sb.Append(" |");
_tr.WriteLine(sb.ToString());
sb.Clear();
for (i = 4; i < 8; i++)
sb.AppendFormat("| {0} ", buffer[i].zToHex());
sb.Append(" |");
_tr.WriteLine(sb.ToString());
sb.Clear();
for (i = 8; i < 12; i++)
sb.AppendFormat("| {0} ", buffer[i].zToHex());
sb.Append(" |");
_tr.WriteLine(sb.ToString());
sb.Clear();
for (i = 12; i < 16; i++)
sb.AppendFormat("| {0} ", buffer[i].zToHex());
sb.Append(" |");
_tr.WriteLine(sb.ToString());
sb.Clear();
for (i = 16; i < 20; i++)
sb.AppendFormat("| {0} ", buffer[i].zToHex());
sb.Append(" |");
_tr.WriteLine(sb.ToString());
_tr.WriteLine("--------------------------------------------------------------------------------------------------");
//_tr.WriteLine("| version | ihl | dscp | ecn | total length |");
//_tr.WriteLine("| 4 | 15 | dscp | ecn | 12345 |");
_tr.WriteLine("| {0} | {1,2} | 0x{2} | | {3,5} |",
ip.Version, ip.HeaderLength / 4, ip.TypeOfService.zToHex(), ip.TotalLength);
//_tr.WriteLine("| identification | flags | fragment offset |");
//_tr.WriteLine("| 0x0000 | flags | 0x0000 |");
_tr.WriteLine("| 0x{0} | | 0x{1} |", ip.Identification.zToHex(), ip.Fragmentation.Offset.zToHex());
//_tr.WriteLine("| time to live | protocol | header checksum |");
//_tr.WriteLine("| 0x00 | 0x00 | 0x0000 |");
_tr.WriteLine("| 0x{0} | 0x{1} | 0x{2} |",
ip.Ttl.zToHex(), ((byte)ip.Protocol).zToHex(), ip.HeaderChecksum.zToHex());
//_tr.WriteLine("| source ip address |");
//_tr.WriteLine("| 123.123.123.123 |");
_tr.WriteLine("| {0,-15} |", ip.Source);
_tr.WriteLine("| {0,-15} |", ip.Destination);
_tr.WriteLine("-------------------------------------------[ipv4 data]--------------------------------------------");
// | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... |
sb.Clear();
sb.Append("|");
i = 0;
foreach (byte b in ip.Payload)
{
if (++i == 31)
break;
sb.Append(" ");
sb.Append(b.zToHex());
}
if (i != 31)
{
for (; i < 30; i++)
sb.Append(" ");
sb.Append(" |");
}
else
sb.Append(" ... |");
_tr.WriteLine(sb.ToString());
_tr.WriteLine("--------------------------------------------------------------------------------------------------");
_tr.WriteLine();
////************* 0 3 0.465083 192.168.0.1 52581 173.194.66.94 443 TCP ACK 0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A .
////_tr.WriteLine("group no time source port destination port protocal flags length sequence next seq ack number window urgent");
//StringBuilder sb = new StringBuilder();
////_tr.Write("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
//sb.AppendFormat("{0,5} {1,5} {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
//sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.ProtocolCode);
//if (detail)
//{
// TcpDatagram tcp = ppacket.Tcp;
// if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
// {
// sb.AppendFormat(" {0,-20}", ppacket.GetTcpFlagsString());
// sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);
// sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
// tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
// tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);
// int i = 0;
// int maxDataChar = 50;
// foreach (byte b in tcp.Payload)
// {
// if (++i > maxDataChar)
// break;
// if (b >= 32 && b <= 126)
// sb.Append(((char)b).ToString());
// else
// sb.Append(".");
// }
// }
// else if (ppacket.Packet.Ethernet == null)
// sb.Append(" not ethernet");
//}
//_tr.WriteLine(sb.ToString());
}
//public static string GetTcpStreamPacketString1(IndexedTcpConnection tcpConnection, PPacket ppacket, TcpDirection direction, bool printData)
public static string GetTcpStreamPacketString1(PPacket ppacket, TcpDirection direction, bool printData)
{
IpV4Datagram ip = ppacket.Ipv4;
TcpDatagram tcp = ppacket.Tcp;
string saddr = null;
string daddr = null;
string mf = null;
string offset = null;
string id = null;
if (ip != null)
{
saddr = ip.Source.ToString();
daddr = ip.Destination.ToString();
if (tcp != null)
{
saddr += ":" + tcp.SourcePort.ToString();
daddr += ":" + tcp.DestinationPort.ToString();
}
//mf = ip.MoreFragment.ToString();
mf = (ip.Fragmentation.Options == IpV4FragmentationOptions.MoreFragments).ToString();
offset = ip.Fragmentation.Offset.zToHex();
id = ip.Identification.zToHex();
}
StringBuilder sb = new StringBuilder();
//direction
string dir = null;
//if (direction != null)
//{
if (direction == TcpDirection.SourceToDestination)
dir = "--> ";
else
{
dir = "<-- ";
string addr = saddr;
saddr = daddr;
daddr = addr;
}
//}
//sb.Append(string.Format("{0,5} {1,5} {2,10:0.000000} {3,-21} {4}{5,-21} {6,-7}", packet.gGroupNumber, packet.PacketNumber, packet.RelativeTime.TotalSeconds, saddr, dir, daddr, packet.ProtocolCode));
sb.Append(string.Format("{0,5} {1,5} {2,10:0.000000} {3,-21} {4}{5,-21} {6,-7}",
ppacket.GetTcpConnection().Index, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds, saddr, dir, daddr, ppacket.IpProtocolCode));
string align = "";
if (tcp != null)
{
string next_seq;
if (tcp.PayloadLength > 0)
next_seq = "0x" + (tcp.SequenceNumber + (uint)tcp.PayloadLength).zToHex();
else if (tcp.IsSynchronize)
next_seq = "0x" + (tcp.SequenceNumber + 1).zToHex();
else
next_seq = " ";
string dataLength;
if (tcp.PayloadLength > 0)
dataLength = "0x" + ((ushort)tcp.PayloadLength).zToHex();
else
dataLength = " ";
string ack_seq;
if (tcp.AcknowledgmentNumber != 0)
ack_seq = "0x" + tcp.AcknowledgmentNumber.zToHex();
else
ack_seq = " ";
string urg_ptr = null;
if (tcp.UrgentPointer != 0)
urg_ptr = " 0x" + tcp.UrgentPointer.zToHex();
else
align += " ";
//TCPFlags(tcp)
//tcp.GetFlagsString()
sb.Append(string.Format(" {0,-20} {1} 0x{2} {3} {4} 0x{5}{6}", ppacket.GetTcpFlagsString(), dataLength, tcp.SequenceNumber.zToHex(), next_seq, ack_seq, tcp.Window.zToHex(), urg_ptr));
}
else
align += " ";
sb.Append(align + " ");
HttpDatagram http = tcp.Http;
if (http != null)
{
sb.Append("http ");
if (http.IsRequest)
sb.Append("request");
else if (http.IsResponse)
sb.Append("reply ");
else
sb.Append("???? ");
//sb.Append(http.Version.ToString());
}
else
sb.Append(" ");
if (printData && tcp != null && tcp.PayloadLength > 0)
{
//sb.Append(align + " ");
//byte[] data = tcp.Payload;
int i = 0;
//int maxDataChar = 100;
int maxDataChar = 50;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
break;
sb.Append(" ");
sb.Append(b.zToHex());
}
sb.Append(" ");
i = 0;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
break;
if (b >= 32 && b <= 126)
sb.Append((char)b);
else
sb.Append('.');
}
}
return sb.ToString();
}
//private static void PrintIpAdressList(Packet packet)
private static void PrintIpAdressList(PPacket ppacket)
{
Packet packet = ppacket.Packet;
//if (packet.Ethernet == null)
// return;
//IpV4Datagram ip = packet.Ethernet.IpV4;
IpV4Datagram ip = ppacket.Ipv4;
if (ip == null)
return;
uint ipAdress = ip.Source.ToValue();
if (!_ipAdressList.ContainsKey(ipAdress))
{
_ipAdressList.Add(ipAdress, null);
Trace.WriteLine("new ip adress {0}", ip.Source.ToString());
}
ipAdress = ip.Destination.ToValue();
if (!_ipAdressList.ContainsKey(ipAdress))
{
_ipAdressList.Add(ipAdress, null);
Trace.WriteLine("new ip adress {0}", ip.Destination.ToString());
}
//TcpDatagram tcp = ip.Tcp;
TcpDatagram tcp = ppacket.Tcp;
if (tcp == null)
return;
TcpConnection tcpConnection = new TcpConnection(packet);
if (!_tcpStreamList.ContainsKey(tcpConnection))
{
_tcpStreamList.Add(tcpConnection, null);
//_tr.WriteLine("new tcp stream {0}:{1} {2}:{3}", tcpConnection.Source.IpAddress, tcpConnection.Source.Port,
// tcpConnection.Destination.IpAddress, tcpConnection.Destination.Port);
Trace.WriteLine("new tcp stream {0}", tcpConnection.GetConnectionName());
}
}
private void PrintPacketInfos(PPacket ppacket)
{
WriteSeparation();
WriteHeaderValues("packet no " + ppacket.PacketNumber.ToString(), string.Format("relative time {0:0.000000}", ppacket.RelativeTime.TotalSeconds), "packet length", ppacket.Packet.Count);
}
private void writeData(byte[] data, PPacket ppacket, string message)
{
// ignore empty packets
if (data.Length == 0)
return;
if (WriteData != null)
WriteData(data, new TcpStreamWriteDataInfo() { PPacket = ppacket, Message = message, NextSequenceNumber = _sequenceNumber });
_bytesWritten += (uint)data.Length;
_emptyTcpStream = false;
}
public void Add(PPacket ppacket)
{
_ppacket = ppacket;
Add(ppacket.Packet);
}
//public void Add(TcpStreamPacket tcpStreamPacket)
//public void Add(TcpConnection tcpConnection, PPacket ppacket)
public void Add(PPacket ppacket)
{
TcpConnection tcpConnection = ppacket.GetTcpConnection();
if (tcpConnection.Source == _tcpConnection.Source && tcpConnection.Destination == _tcpConnection.Destination)
_streamSourceToDestination.Add(ppacket);
else
_streamDestinationToSource.Add(ppacket);
}
public static void PrintPacketDetailHandler(PPacket ppacket)
{
new PrintPacketDetail()._PrintPacketDetailHandler(ppacket);
}
public void Add(PPacket ppacket)
{
_ppacket = ppacket;
Add(ppacket.Packet);
}
public void _PrintPacketDetailHandler(PPacket ppacket)
{
//try
//{
//------------------------------------------------------------------------------------------------------------------------------
//| packet no 5 | relative time 0.745022 | packet length 55 |
//-------------------------------------------------------[ethernet frame]-------------------------------------------------------
//| 0x0000 | 00 07 CB C1 35 5D | destination MAC address 00:07:CB:C1:35:5D | header length 14 |
//| 0x0006 | 48 5B 39 C0 45 48 | source MAC address 48:5B:39:C0:45:48 | data length 41 |
//| 0x000C | 08 00 | ether type 0x0800 IPv4 | |
//---------------------------------------------------------[ipv4 frame]---------------------------------------------------------
//| 0x000E | 45 | version 4 | header length 20 |
//| | | internet header length (ihl) 5 | data length 21 |
//| 0x000F | 00 | dscp 0x00 | |
//| | | ecn | |
//| 0x0010 | 00 29 | total length 41 | |
//| 0x0012 | 4F F9 | identification 0x4FF9 | |
//| 0x0014 | 40 00 | flags | |
//| | | fragment offset 0x0000 | |
//| 0x0016 | 80 | time to live 0x80 | |
//| 0x0017 | 06 | protocol 0x06 TCP | |
//| 0x0018 | 1A 47 | header checksum 0x1A47 | |
//| 0x001A | C0 A8 00 01 | source ip address 192.168.0.1 | |
//| 0x001E | AD C2 22 23 | destination ip address 173.194.34.35 | |
//| | | options (if ihl > 5) | |
//| 0x0022 | CD 67 01 BB E9 DF 53 5D | data | |
//| 0x002A | 91 1F 42 06 50 10 40 3D | | |
//| 0x0032 | FF 81 00 00 00 | | |
//------------------------------------------------------------------------------------------------------------------------------
//if (ip.Tcp != null && ip.Tcp.Http.Version == null)
// return;
PrintPacketInfos(ppacket);
_dataLength = (ushort)ppacket.Packet.Count;
_dataEnum = ppacket.Packet.zAsEnumerableWithCounter();
PrintEthernet(ppacket);
EthernetDatagram ethernet = ppacket.Packet.Ethernet;
if (ethernet.EtherType == EthernetType.IpV4)
{
PrintIpV4(ppacket);
IpV4Datagram ip = ethernet.IpV4;
if (ip.Protocol == IpV4Protocol.Tcp)
{
PrintTcp(ppacket);
if (ip.Tcp.Http.Version != null)
PrintHttp(ppacket);
}
}
WriteSeparation();
Trace.WriteLine();
//}
//finally
//{
// WriteSeparation();
// Trace.WriteLine();
//}
}