Exemple #1
0
        public void Add(PPacket ppacket)
        {
            _totalPacketsCount++;
            if (ppacket.Tcp == null)
            {
                return;
            }
            _selectionnedPacketsCount++;
            //IndexedTcpConnection tcpConnection = new IndexedTcpConnection(ppacket.Packet);
            TcpConnection  tcpConnection = ppacket.GetTcpConnection();
            int            i             = _tcpStreamPacketsList.IndexOfKey(tcpConnection);
            List <PPacket> ppacketList;

            if (i == -1)
            {
                tcpConnection.Index = ++_tcpConnectionIndex;
                ppacketList         = new List <PPacket>();
                _tcpStreamPacketsList.Add(tcpConnection, ppacketList);
            }
            else
            {
                tcpConnection.Index = _tcpStreamPacketsList.Keys[i].Index;
                ppacketList         = _tcpStreamPacketsList.Values[i];
            }
            ppacketList.Add(ppacket);
        }
Exemple #2
0
        private void PrintIpV4(PPacket ppacket)
        {
            //EthernetDatagram ethernet = ppacket.Packet.Ethernet;
            IpV4Datagram ip = ppacket.Packet.Ethernet.IpV4;
            //if (ethernet.EtherType != EthernetType.IpV4)
            //    return;
            _dataLength -= (ushort)ip.HeaderLength;

            WriteTitle("[ipv4 frame]");
            WriteValues(1, "version", ip.Version, "header length", ip.HeaderLength);
            //WriteValues(0, "internet header length (ihl)", ip.HeaderLength / 4, "data length", _dataLength);
            WriteValues(0, "internet header length (ihl)", ip.HeaderLength / 4);
            WriteValues(1, "dscp", "0x" + ip.TypeOfService.zToHex());
            WriteValues(0, "ecn");
            WriteValues(2, "total length", ip.TotalLength);
            WriteValues(2, "identification", "0x" + ip.Identification.zToHex());
            WriteValues(2, "flags");
            WriteValues(0, "fragment offset", "0x" + ip.Fragmentation.Offset.zToHex());
            WriteValues(1, "time to live", "0x" + ip.Ttl.zToHex());
            WriteValues(1, "protocol", "0x" + ((byte)ip.Protocol).zToHex() + " " + ppacket.IpProtocolCode);
            WriteValues(2, "header checksum", "0x" + ip.HeaderChecksum.zToHex());
            WriteValues(4, "source ip address", ip.Source);
            WriteValues(4, "destination ip address", ip.Destination);
            WriteValues(ip.HeaderLength - 20, "options (if ihl > 5)");
            WriteTitle("[ipv4 data]");
            WritePayloadData(48, ip.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
        }
Exemple #3
0
        //private int _packetIndex = 1;
        private void PacketHandle(PPacket ppacket)
        {
            //if (ppacket.Packet.Ethernet == null || ppacket.Packet.Ethernet.IpV4 == null || ppacket.Packet.Ethernet.IpV4.Tcp == null)
            if (ppacket.Ipv4 == null || ppacket.Tcp == null)
                return;

            //TcpStreamPacket tcpStreamPacket = new TcpStreamPacket(packet);
            //TcpConnection tcpConnection = tcpStreamPacket.Connection;
            //TcpConnection tcpConnection = new TcpConnection(ppacket.Packet);
            TcpConnection tcpConnection = ppacket.GetTcpConnection();
            if (!_tcpStreamList.ContainsKey(tcpConnection))
            {
                TcpStream tcpStream = new TcpStream(tcpConnection);
                _tcpStreamList.Add(tcpConnection, tcpStream);

                //WriteTcpStreamToFile writeTcpStreamToFile = new WriteTcpStreamToFile(tcpStream, _directory);
                //_tcpStreamToFileList.Add(writeTcpStreamToFile);
                //new CreatePacketTcpStream(tcpStream).TcpPacketHandle = (direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); };
                //if (_trace)
                //    new TraceTcpStream(tcpStream);

                tcpStream.zWriteTcpStreamToFile(_directory);
                //tcpStream.CreatePacketTcpStream((direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); });
                tcpStream.zTcpStreamReassembledPacket((direction, tcpPacket) => { PrintPacket.PrintPacket1(_ppacketManager.CreatePPacket(tcpPacket), true); });
                if (_trace)
                    tcpStream.zTraceTcpStream(_directory);
            }
            //Trace.CurrentTrace.WriteLine("packet no {0} {1}:{2} - {3}:{4}", _packetIndex++, tcpConnection.Source.Address, tcpConnection.Source.Port, tcpConnection.Destination.Address, tcpConnection.Destination.Port);
            //_tcpStreamList[tcpConnection].Add(tcpStreamPacket);
            //_tcpStreamList[tcpConnection].Add(tcpConnection, ppacket);
            _tcpStreamList[tcpConnection].Add(ppacket);
        }
Exemple #4
0
 private void PrintHttp(PPacket ppacket)
 {
     HttpDatagram http = ppacket.Packet.Ethernet.IpV4.Tcp.Http;
     //ReadOnlyCollection<HttpDatagram> httpCollection = ppacket.Packet.Ethernet.IpV4.Tcp.HttpCollection;
     WriteTitle("[http]");
     WriteValues(0, "version", http.Version != null ? http.Version.ToString() : "null");
     WriteValues(0, "is request", http.IsRequest);
     WriteValues(0, "is response", http.IsResponse);
     WriteValues(0, "header", http.Header != null ? http.Header.ToString() : "null");
 }
Exemple #5
0
        //public void Add(TcpStreamPacket tcpStreamPacket)
        //public void Add(TcpConnection tcpConnection, PPacket ppacket)
        public void Add(PPacket ppacket)
        {
            TcpConnection tcpConnection = ppacket.GetTcpConnection();

            if (tcpConnection.Source == _tcpConnection.Source && tcpConnection.Destination == _tcpConnection.Destination)
            {
                _streamSourceToDestination.Add(ppacket);
            }
            else
            {
                _streamDestinationToSource.Add(ppacket);
            }
        }
Exemple #6
0
 private void PrintEthernet(PPacket ppacket)
 {
     EthernetDatagram ethernet = ppacket.Packet.Ethernet;
     if (ethernet == null)
         return;
     _dataLength -= 14;
     WriteTitle("[ethernet frame]");
     WriteValues(6, "destination MAC address", ethernet.Destination, "header length", 14);
     //WriteValues(6, "source MAC address", ethernet.Source, "data length", _dataLength);
     WriteValues(6, "source MAC address", ethernet.Source);
     WriteValues(2, "ether type", "0x" + ((ushort)ethernet.EtherType).zToHex() + "  " + ppacket.EthernetTypeCode);
     WriteTitle("[ethernet data]");
     WritePayloadData(48, ethernet.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
 }
Exemple #7
0
        public static void PrintPacket1(PPacket ppacket, bool detail = false, ITrace trace = null)
        {
            if (trace == null)
            {
                trace = Trace.CurrentTrace;
            }
            //*************    0      3    0.465083 192.168.0.1     52581 173.194.66.94     443 TCP         ACK                  0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A       .
            //_tr.WriteLine("group     no    time     source           port destination      port protocal    flags                length sequence   next seq   ack number window urgent");
            StringBuilder sb = new StringBuilder();

            //_tr.Write("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            sb.AppendFormat("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.IpProtocolCode);
            if (detail)
            {
                TcpDatagram tcp = ppacket.Tcp;
                if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
                {
                    sb.AppendFormat("  {0,-20}", ppacket.GetTcpFlagsString());
                    sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);

                    sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
                                    tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
                                    tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);

                    int i           = 0;
                    int maxDataChar = 50;
                    foreach (byte b in tcp.Payload)
                    {
                        if (++i > maxDataChar)
                        {
                            break;
                        }
                        if (b >= 32 && b <= 126)
                        {
                            sb.Append(((char)b).ToString());
                        }
                        else
                        {
                            sb.Append(".");
                        }
                    }
                }
                else if (ppacket.Packet.Ethernet == null)
                {
                    sb.Append(" not ethernet");
                }
            }
            trace.WriteLine(sb.ToString());
        }
Exemple #8
0
        private void writeData(byte[] data, PPacket ppacket, string message)
        {
            // ignore empty packets
            if (data.Length == 0)
            {
                return;
            }

            if (WriteData != null)
            {
                WriteData(data, new TcpStreamWriteDataInfo()
                {
                    PPacket = ppacket, Message = message, NextSequenceNumber = _sequenceNumber
                });
            }

            _bytesWritten  += (uint)data.Length;
            _emptyTcpStream = false;
        }
Exemple #9
0
        public static void PrintPacket1(PPacket ppacket, bool detail = false, ITrace trace = null)
        {
            if (trace == null)
                trace = Trace.CurrentTrace;
            //*************    0      3    0.465083 192.168.0.1     52581 173.194.66.94     443 TCP         ACK                  0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A       .
            //_tr.WriteLine("group     no    time     source           port destination      port protocal    flags                length sequence   next seq   ack number window urgent");
            StringBuilder sb = new StringBuilder();
            //_tr.Write("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            sb.AppendFormat("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.IpProtocolCode);
            if (detail)
            {
                TcpDatagram tcp = ppacket.Tcp;
                if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
                {
                    sb.AppendFormat("  {0,-20}", ppacket.GetTcpFlagsString());
                    sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);

                    sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
                        tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
                        tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);

                    int i = 0;
                    int maxDataChar = 50;
                    foreach (byte b in tcp.Payload)
                    {
                        if (++i > maxDataChar)
                            break;
                        if (b >= 32 && b <= 126)
                            sb.Append(((char)b).ToString());
                        else
                            sb.Append(".");
                    }


                }
                else if (ppacket.Packet.Ethernet == null)
                    sb.Append(" not ethernet");
            }
            trace.WriteLine(sb.ToString());
        }
Exemple #10
0
        private void PrintTcp(PPacket ppacket)
        {
            //IpV4Datagram ip = ppacket.Packet.Ethernet.IpV4;
            TcpDatagram tcp = ppacket.Packet.Ethernet.IpV4.Tcp;
            //if (ip.Protocol != IpV4Protocol.Tcp)
            //    return;
            _dataLength -= (ushort)tcp.RealHeaderLength;

            WriteTitle("[tcp frame]");
            WriteValues(2, "source port", tcp.SourcePort, "header length", tcp.RealHeaderLength);
            //WriteValues(2, "destination port", tcp.DestinationPort, "data length", _dataLength);
            WriteValues(2, "destination port", tcp.DestinationPort);
            WriteValues(4, "sequence number", "0x" + tcp.SequenceNumber.zToHex());
            WriteValues(4, "acknowledgment number", "0x" + tcp.AcknowledgmentNumber.zToHex());
            WriteValues(2, "data offset", "0x" + ((byte)tcp.HeaderLength).zToHex());
            WriteValues(0, "ecn", tcp.IsExplicitCongestionNotificationEcho);
            WriteValues(0, "cwr", tcp.IsCongestionWindowReduced);
            WriteValues(0, "ece", tcp.IsExplicitCongestionNotificationEcho);
            WriteValues(0, "urg", tcp.IsUrgent);
            WriteValues(0, "ack", tcp.IsAcknowledgment);
            WriteValues(0, "psh", tcp.IsPush);
            WriteValues(0, "rst", tcp.IsReset);
            WriteValues(0, "syn", tcp.IsSynchronize);
            WriteValues(0, "fin", tcp.IsFin);
            WriteValues(2, "window size", "0x" + tcp.Window.zToHex());
            WriteValues(2, "checksum", "0x" + tcp.Checksum.zToHex());
            WriteValues(2, "urgent pointer", "0x" + tcp.UrgentPointer.zToHex());
            int optionLength = tcp.RealHeaderLength - 20;
            int n = Math.Min(8, optionLength);
            WriteValues(n, "options", null, "options length", optionLength);
            optionLength -= n;
            while (optionLength > 0)
            {
                n = Math.Min(8, optionLength);
                WriteValues(n);
                optionLength -= n;
            }
            WriteTitle("[tcp data]");
            WritePayloadData(48, tcp.Payload.zAsEnumerableWithCounter(_dataEnum.Index));
        }
Exemple #11
0
        //private static void PrintSortedTcpStreamPacket(IndexedTcpConnection tcpConnection, PPacket ppacket)
        private static void PrintSortedTcpStreamPacket(PPacket ppacket)
        {
            TcpConnection tcpConnection = ppacket.GetTcpConnection();
            if (_currentTcpConnection == null || tcpConnection.Index != _currentTcpConnection.Index)
            {
                Trace.WriteLine();
                Trace.WriteLine("group packet    time      source                 dir   destination           protocol flags                data   seq        next seq   ack        window urg       data");
                //_LastStreamNumber = tcpConnection.Index;
                _currentTcpConnection = tcpConnection;
            }
            //TcpDirection direction = TcpDirection.SourceToDestination;
            //string s = GetTcpStreamPacketString1(tcpConnection, ppacket, _currentTcpConnection.GetTcpDirection(tcpConnection), true);
            string s = GetTcpStreamPacketString1(ppacket, _currentTcpConnection.GetTcpDirection(tcpConnection), true);
            //string s2 = null;
            //foreach (Pib.Pcap.Test.TcpPacketError error in streamPacket.Errors)
            //    s2 = s2.zAddValue(streamPacket.GetErrorMessage(error));

            //if (s2 != null)
            //    s2 = " " + s2;
            //Trace.WriteLine("{0,-162}{1}{2}", s, ppacket.GetTcpDescription(), s2);
            Trace.WriteLine(s);
        }
Exemple #12
0
 public void Add(PPacket ppacket)
 {
     _totalPacketsCount++;
     if (ppacket.Tcp == null)
         return;
     _selectionnedPacketsCount++;
     //IndexedTcpConnection tcpConnection = new IndexedTcpConnection(ppacket.Packet);
     TcpConnection tcpConnection = ppacket.GetTcpConnection();
     int i = _tcpStreamPacketsList.IndexOfKey(tcpConnection);
     List<PPacket> ppacketList;
     if (i == -1)
     {
         tcpConnection.Index = ++_tcpConnectionIndex;
         ppacketList = new List<PPacket>();
         _tcpStreamPacketsList.Add(tcpConnection, ppacketList);
     }
     else
     {
         tcpConnection.Index = _tcpStreamPacketsList.Keys[i].Index;
         ppacketList = _tcpStreamPacketsList.Values[i];
     }
     ppacketList.Add(ppacket);
 }
Exemple #13
0
        //private int _packetIndex = 1;
        private void PacketHandle(PPacket ppacket)
        {
            //if (ppacket.Packet.Ethernet == null || ppacket.Packet.Ethernet.IpV4 == null || ppacket.Packet.Ethernet.IpV4.Tcp == null)
            if (ppacket.Ipv4 == null || ppacket.Tcp == null)
            {
                return;
            }

            //TcpStreamPacket tcpStreamPacket = new TcpStreamPacket(packet);
            //TcpConnection tcpConnection = tcpStreamPacket.Connection;
            //TcpConnection tcpConnection = new TcpConnection(ppacket.Packet);
            TcpConnection tcpConnection = ppacket.GetTcpConnection();

            if (!_tcpStreamList.ContainsKey(tcpConnection))
            {
                TcpStream tcpStream = new TcpStream(tcpConnection);
                _tcpStreamList.Add(tcpConnection, tcpStream);

                //WriteTcpStreamToFile writeTcpStreamToFile = new WriteTcpStreamToFile(tcpStream, _directory);
                //_tcpStreamToFileList.Add(writeTcpStreamToFile);
                //new CreatePacketTcpStream(tcpStream).TcpPacketHandle = (direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); };
                //if (_trace)
                //    new TraceTcpStream(tcpStream);

                tcpStream.zWriteTcpStreamToFile(_directory);
                //tcpStream.CreatePacketTcpStream((direction, tcpPacket) => { w.PrintPacketHandler2(_ppacketManager.CreatePPacket(tcpPacket), true); });
                tcpStream.zTcpStreamReassembledPacket((direction, tcpPacket) => { PrintPacket.PrintPacket1(_ppacketManager.CreatePPacket(tcpPacket), true); });
                if (_trace)
                {
                    tcpStream.zTraceTcpStream(_directory);
                }
            }
            //Trace.CurrentTrace.WriteLine("packet no {0} {1}:{2} - {3}:{4}", _packetIndex++, tcpConnection.Source.Address, tcpConnection.Source.Port, tcpConnection.Destination.Address, tcpConnection.Destination.Port);
            //_tcpStreamList[tcpConnection].Add(tcpStreamPacket);
            //_tcpStreamList[tcpConnection].Add(tcpConnection, ppacket);
            _tcpStreamList[tcpConnection].Add(ppacket);
        }
Exemple #14
0
        private static void PrintPacketDetailHandlerOld(PPacket ppacket)
        {
            EthernetDatagram ethernet = ppacket.Packet.Ethernet;
            if (ethernet == null)
            {
                _tr.WriteLine("---------------------------------------------[not ethernet packet]---------------------------------------------");
                _tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
                _tr.WriteLine();
                return;
            }
            _tr.WriteLine("----------------------------------[ethernet type II frame (64 to 1518 bytes)]----------------------------------");
            _tr.WriteLine("| dest MAC address   src MAC address    ether type  data (46-1500 bytes)   length  CRC checksum  total length |");
            _tr.WriteLine("| XX:XX:XX:XX:XX:XX  XX:XX:XX:XX:XX:XX  XX XX       XX XX XX XX XX XX ...          XX XX XX XX                |");
            _tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
            StringBuilder sb = new StringBuilder();
            sb.Append("|");
            byte[] buffer = ppacket.Packet.Buffer;
            int i = 0;
            foreach (byte b in buffer)
            {
                if (i == 6 || i == 12)
                    sb.Append(" ");
                else if (i == 14)
                    sb.Append("      ");
                else if (i == 20)
                {
                    sb.Append(" ... ");
                    sb.AppendFormat(" {0,6} ", ethernet.PayloadLength);
                    break;
                }
                sb.Append(" ");
                sb.Append(b.zToHex());
                i++;
            }
            //for (i = buffer.Length - 4; i < buffer.Length; i++)
            //{
            //    byte b = buffer[i];
            //    sb.Append(" ");
            //    sb.Append(b.zToHex());
            //}
            sb.Append("            ");
            //  total length
            sb.AppendFormat("         {0,6} |", ppacket.Packet.Count);
            _tr.WriteLine(sb.ToString());
            _tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
            sb.Clear();
            sb.AppendFormat("| {0}  {1}  {2}       ", ethernet.Destination, ethernet.Source, ((ushort)ethernet.EtherType).zToHex());
            i = 0;
            foreach (byte b in ethernet.Payload)
            {
                if (i++ == 6)
                    break;
                sb.Append(" ");
                sb.Append(b.zToHex());
            }
            sb.Append(" ... ");
            sb.AppendFormat(" {0,6} ", ethernet.PayloadLength);
            if (ethernet.FrameCheckSequence != null)
            {
                foreach (byte b in ethernet.FrameCheckSequence)
                {
                    sb.Append(" ");
                    sb.Append(b.zToHex());
                }
            }
            else
                sb.Append("            ");
            sb.AppendFormat("         {0,6} |", ppacket.Packet.Count);
            _tr.WriteLine(sb.ToString());
            _tr.WriteLine("|                                       {0,-25}                                             |", ppacket.EthernetTypeCode);
            _tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
            IpV4Datagram ip = ethernet.IpV4;
            if (ip == null)
            {
                _tr.WriteLine("-----------------------------------------------[not ipv4 packet]-----------------------------------------------");
                _tr.WriteLine("---------------------------------------------------------------------------------------------------------------");
                _tr.WriteLine();
                return;
            }
            buffer = ip.ToArray();
            _tr.WriteLine("------------------------------------------[ipv4 header]-------------------------------------------");
            _tr.WriteLine("| 0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |");
            _tr.WriteLine("|  version  |    ihl    |      dscp       | ecn |                  total length                  |");
            _tr.WriteLine("|                identification                 | flags  |            fragment offset            |");
            _tr.WriteLine("|     time to live      |       protocol        |                header checksum                 |");
            _tr.WriteLine("|                                       source ip address                                        |");
            _tr.WriteLine("|                                     destination ip address                                     |");
            _tr.WriteLine("|                                      options (if ihl > 5)                                      |");
            _tr.WriteLine("--------------------------------------------------------------------------------------------------");
            sb.Clear();
            for (i = 0; i < 4; i++)
                sb.AppendFormat("|          {0}           ", buffer[i].zToHex());
            sb.Append(" |");
            _tr.WriteLine(sb.ToString());
            sb.Clear();
            for (i = 4; i < 8; i++)
                sb.AppendFormat("|          {0}           ", buffer[i].zToHex());
            sb.Append(" |");
            _tr.WriteLine(sb.ToString());
            sb.Clear();
            for (i = 8; i < 12; i++)
                sb.AppendFormat("|          {0}           ", buffer[i].zToHex());
            sb.Append(" |");
            _tr.WriteLine(sb.ToString());
            sb.Clear();
            for (i = 12; i < 16; i++)
                sb.AppendFormat("|          {0}           ", buffer[i].zToHex());
            sb.Append(" |");
            _tr.WriteLine(sb.ToString());
            sb.Clear();
            for (i = 16; i < 20; i++)
                sb.AppendFormat("|          {0}           ", buffer[i].zToHex());
            sb.Append(" |");
            _tr.WriteLine(sb.ToString());
            _tr.WriteLine("--------------------------------------------------------------------------------------------------");
            //_tr.WriteLine("|  version  |    ihl    |      dscp       | ecn |                  total length                  |");
            //_tr.WriteLine("|     4     |    15     |      dscp       | ecn |                     12345                      |");
            _tr.WriteLine("|     {0}     |    {1,2}     |      0x{2}       |     |                     {3,5}                      |",
                ip.Version, ip.HeaderLength / 4, ip.TypeOfService.zToHex(), ip.TotalLength);
            //_tr.WriteLine("|                identification                 | flags  |            fragment offset            |");
            //_tr.WriteLine("|                    0x0000                     | flags  |                0x0000                 |");
            _tr.WriteLine("|                    0x{0}                     |        |                0x{1}                 |", ip.Identification.zToHex(), ip.Fragmentation.Offset.zToHex());
            //_tr.WriteLine("|     time to live      |       protocol        |                header checksum                 |");
            //_tr.WriteLine("|         0x00          |         0x00          |                    0x0000                      |");
            _tr.WriteLine("|         0x{0}          |         0x{1}          |                    0x{2}                      |",
                ip.Ttl.zToHex(), ((byte)ip.Protocol).zToHex(), ip.HeaderChecksum.zToHex());
            //_tr.WriteLine("|                                       source ip address                                        |");
            //_tr.WriteLine("|                                        123.123.123.123                                         |");
            _tr.WriteLine("|                                        {0,-15}                                         |", ip.Source);
            _tr.WriteLine("|                                        {0,-15}                                         |", ip.Destination);
            _tr.WriteLine("-------------------------------------------[ipv4 data]--------------------------------------------");
            //             | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...  |
            sb.Clear();
            sb.Append("|");
            i = 0;
            foreach (byte b in ip.Payload)
            {
                if (++i == 31)
                    break;
                sb.Append(" ");
                sb.Append(b.zToHex());
            }
            if (i != 31)
            {
                for (; i < 30; i++)
                    sb.Append("   ");
                sb.Append("      |");
            }
            else
                sb.Append(" ...  |");
            _tr.WriteLine(sb.ToString());
            _tr.WriteLine("--------------------------------------------------------------------------------------------------");
            _tr.WriteLine();







            ////*************    0      3    0.465083 192.168.0.1     52581 173.194.66.94     443 TCP         ACK                  0x0001 0x4B2091F9 0x4B2091FA 0x4695DD86 0x401A       .
            ////_tr.WriteLine("group     no    time     source           port destination      port protocal    flags                length sequence   next seq   ack number window urgent");
            //StringBuilder sb = new StringBuilder();
            ////_tr.Write("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            //sb.AppendFormat("{0,5}  {1,5}  {2,10:0.000000}", ppacket.GroupNumber, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds);
            //sb.AppendFormat(" {0,-15} {1,5} {2,-15} {3,5} {4,-10}", ppacket.Source, ppacket.SourcePort, ppacket.Destination, ppacket.DestinationPort, ppacket.ProtocolCode);
            //if (detail)
            //{
            //    TcpDatagram tcp = ppacket.Tcp;
            //    if (tcp != null && ppacket.Ipv4.Protocol == IpV4Protocol.Tcp)
            //    {
            //        sb.AppendFormat("  {0,-20}", ppacket.GetTcpFlagsString());
            //        sb.AppendFormat(" {0,6}", tcp.PayloadLength > 0 ? "0x" + ((short)tcp.PayloadLength).zToHex() : null);

            //        sb.AppendFormat(" 0x{0} {1,10} {2,10} {3,6} {4,6}", ppacket.Tcp.SequenceNumber.zToHex(), tcp.NextSequenceNumber != tcp.SequenceNumber ? "0x" + tcp.NextSequenceNumber.zToHex() : null,
            //            tcp.AcknowledgmentNumber != 0 ? "0x" + tcp.AcknowledgmentNumber.zToHex() : null, "0x" + tcp.Window.zToHex(),
            //            tcp.UrgentPointer != 0 ? "0x" + tcp.UrgentPointer.zToHex() : null);

            //        int i = 0;
            //        int maxDataChar = 50;
            //        foreach (byte b in tcp.Payload)
            //        {
            //            if (++i > maxDataChar)
            //                break;
            //            if (b >= 32 && b <= 126)
            //                sb.Append(((char)b).ToString());
            //            else
            //                sb.Append(".");
            //        }


            //    }
            //    else if (ppacket.Packet.Ethernet == null)
            //        sb.Append(" not ethernet");
            //}
            //_tr.WriteLine(sb.ToString());
        }
Exemple #15
0
 //public static string GetTcpStreamPacketString1(IndexedTcpConnection tcpConnection, PPacket ppacket, TcpDirection direction, bool printData)
 public static string GetTcpStreamPacketString1(PPacket ppacket, TcpDirection direction, bool printData)
 {
     IpV4Datagram ip = ppacket.Ipv4;
     TcpDatagram tcp = ppacket.Tcp;
     string saddr = null;
     string daddr = null;
     string mf = null;
     string offset = null;
     string id = null;
     if (ip != null)
     {
         saddr = ip.Source.ToString();
         daddr = ip.Destination.ToString();
         if (tcp != null)
         {
             saddr += ":" + tcp.SourcePort.ToString();
             daddr += ":" + tcp.DestinationPort.ToString();
         }
         //mf = ip.MoreFragment.ToString();
         mf = (ip.Fragmentation.Options == IpV4FragmentationOptions.MoreFragments).ToString();
         offset = ip.Fragmentation.Offset.zToHex();
         id = ip.Identification.zToHex();
     }
     StringBuilder sb = new StringBuilder();
     //direction
     string dir = null;
     //if (direction != null)
     //{
         if (direction == TcpDirection.SourceToDestination)
             dir = "-->   ";
         else
         {
             dir = "<--   ";
             string addr = saddr;
             saddr = daddr;
             daddr = addr;
         }
     //}
     //sb.Append(string.Format("{0,5}  {1,5}  {2,10:0.000000}  {3,-21}  {4}{5,-21} {6,-7}", packet.gGroupNumber, packet.PacketNumber, packet.RelativeTime.TotalSeconds, saddr, dir, daddr, packet.ProtocolCode));
     sb.Append(string.Format("{0,5}  {1,5}  {2,10:0.000000}  {3,-21}  {4}{5,-21} {6,-7}",
         ppacket.GetTcpConnection().Index, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds, saddr, dir, daddr, ppacket.IpProtocolCode));
     string align = "";
     if (tcp != null)
     {
         string next_seq;
         if (tcp.PayloadLength > 0)
             next_seq = "0x" + (tcp.SequenceNumber + (uint)tcp.PayloadLength).zToHex();
         else if (tcp.IsSynchronize)
             next_seq = "0x" + (tcp.SequenceNumber + 1).zToHex();
         else
             next_seq = "          ";
         string dataLength;
         if (tcp.PayloadLength > 0)
             dataLength = "0x" + ((ushort)tcp.PayloadLength).zToHex();
         else
             dataLength = "      ";
         string ack_seq;
         if (tcp.AcknowledgmentNumber != 0)
             ack_seq = "0x" + tcp.AcknowledgmentNumber.zToHex();
         else
             ack_seq = "          ";
         string urg_ptr = null;
         if (tcp.UrgentPointer != 0)
             urg_ptr = " 0x" + tcp.UrgentPointer.zToHex();
         else
             align += "       ";
         //TCPFlags(tcp)
         //tcp.GetFlagsString()
         sb.Append(string.Format("  {0,-20} {1} 0x{2} {3} {4} 0x{5}{6}", ppacket.GetTcpFlagsString(), dataLength, tcp.SequenceNumber.zToHex(), next_seq, ack_seq, tcp.Window.zToHex(), urg_ptr));
     }
     else
         align += "                                                                                    ";
     sb.Append(align + "   ");
     HttpDatagram http = tcp.Http;
     if (http != null)
     {
         sb.Append("http ");
         if (http.IsRequest)
             sb.Append("request");
         else if (http.IsResponse)
             sb.Append("reply  ");
         else
             sb.Append("????   ");
         //sb.Append(http.Version.ToString());
     }
     else
         sb.Append("                      ");
     if (printData && tcp != null && tcp.PayloadLength > 0)
     {
         //sb.Append(align + "   ");
         //byte[] data = tcp.Payload;
         int i = 0;
         //int maxDataChar = 100;
         int maxDataChar = 50;
         foreach (byte b in tcp.Payload)
         {
             if (++i > maxDataChar)
                 break;
             sb.Append(" ");
             sb.Append(b.zToHex());
         }
         sb.Append("  ");
         i = 0;
         foreach (byte b in tcp.Payload)
         {
             if (++i > maxDataChar)
                 break;
             if (b >= 32 && b <= 126)
                 sb.Append((char)b);
             else
                 sb.Append('.');
         }
     }
     return sb.ToString();
 }
Exemple #16
0
 //private static void PrintIpAdressList(Packet packet)
 private static void PrintIpAdressList(PPacket ppacket)
 {
     Packet packet = ppacket.Packet;
     //if (packet.Ethernet == null)
     //    return;
     //IpV4Datagram ip = packet.Ethernet.IpV4;
     IpV4Datagram ip = ppacket.Ipv4;
     if (ip == null)
         return;
     uint ipAdress = ip.Source.ToValue();
     if (!_ipAdressList.ContainsKey(ipAdress))
     {
         _ipAdressList.Add(ipAdress, null);
         Trace.WriteLine("new ip adress {0}", ip.Source.ToString());
     }
     ipAdress = ip.Destination.ToValue();
     if (!_ipAdressList.ContainsKey(ipAdress))
     {
         _ipAdressList.Add(ipAdress, null);
         Trace.WriteLine("new ip adress {0}", ip.Destination.ToString());
     }
     //TcpDatagram tcp = ip.Tcp;
     TcpDatagram tcp = ppacket.Tcp;
     if (tcp == null)
         return;
     TcpConnection tcpConnection = new TcpConnection(packet);
     if (!_tcpStreamList.ContainsKey(tcpConnection))
     {
         _tcpStreamList.Add(tcpConnection, null);
         //_tr.WriteLine("new tcp stream {0}:{1} {2}:{3}", tcpConnection.Source.IpAddress, tcpConnection.Source.Port,
         //    tcpConnection.Destination.IpAddress, tcpConnection.Destination.Port);
         Trace.WriteLine("new tcp stream {0}", tcpConnection.GetConnectionName());
     }
 }
Exemple #17
0
 private void PrintPacketInfos(PPacket ppacket)
 {
     WriteSeparation();
     WriteHeaderValues("packet no " + ppacket.PacketNumber.ToString(), string.Format("relative time {0:0.000000}", ppacket.RelativeTime.TotalSeconds), "packet length", ppacket.Packet.Count);
 }
Exemple #18
0
        private void writeData(byte[] data, PPacket ppacket, string message)
        {
            // ignore empty packets
            if (data.Length == 0)
                return;

            if (WriteData != null)
                WriteData(data, new TcpStreamWriteDataInfo() { PPacket = ppacket, Message = message, NextSequenceNumber = _sequenceNumber });

            _bytesWritten += (uint)data.Length;
            _emptyTcpStream = false;
        }
Exemple #19
0
 public void Add(PPacket ppacket)
 {
     _ppacket = ppacket;
     Add(ppacket.Packet);
 }
Exemple #20
0
 //public void Add(TcpStreamPacket tcpStreamPacket)
 //public void Add(TcpConnection tcpConnection, PPacket ppacket)
 public void Add(PPacket ppacket)
 {
     TcpConnection tcpConnection = ppacket.GetTcpConnection();
     if (tcpConnection.Source == _tcpConnection.Source && tcpConnection.Destination == _tcpConnection.Destination)
         _streamSourceToDestination.Add(ppacket);
     else
         _streamDestinationToSource.Add(ppacket);
 }
Exemple #21
0
 public static void PrintPacketDetailHandler(PPacket ppacket)
 {
     new PrintPacketDetail()._PrintPacketDetailHandler(ppacket);
 }
Exemple #22
0
 public void Add(PPacket ppacket)
 {
     _ppacket = ppacket;
     Add(ppacket.Packet);
 }
Exemple #23
0
        public void _PrintPacketDetailHandler(PPacket ppacket)
        {
            //try
            //{
                //------------------------------------------------------------------------------------------------------------------------------
                //| packet no 5                      | relative time 0.745022                                            | packet length 55    |
                //-------------------------------------------------------[ethernet frame]-------------------------------------------------------
                //| 0x0000 | 00 07 CB C1 35 5D       | destination MAC address         00:07:CB:C1:35:5D                 | header length 14    |
                //| 0x0006 | 48 5B 39 C0 45 48       | source MAC address              48:5B:39:C0:45:48                 | data length   41    |
                //| 0x000C | 08 00                   | ether type                      0x0800  IPv4                      |                     |
                //---------------------------------------------------------[ipv4 frame]---------------------------------------------------------
                //| 0x000E | 45                      | version                         4                                 | header length 20    |
                //|        |                         | internet header length (ihl)    5                                 | data length   21    |
                //| 0x000F | 00                      | dscp                            0x00                              |                     |
                //|        |                         | ecn                                                               |                     |
                //| 0x0010 | 00 29                   | total length                    41                                |                     |
                //| 0x0012 | 4F F9                   | identification                  0x4FF9                            |                     |
                //| 0x0014 | 40 00                   | flags                                                             |                     |
                //|        |                         | fragment offset                 0x0000                            |                     |
                //| 0x0016 | 80                      | time to live                    0x80                              |                     |
                //| 0x0017 | 06                      | protocol                        0x06 TCP                          |                     |
                //| 0x0018 | 1A 47                   | header checksum                 0x1A47                            |                     |
                //| 0x001A | C0 A8 00 01             | source ip address               192.168.0.1                       |                     |
                //| 0x001E | AD C2 22 23             | destination ip address          173.194.34.35                     |                     |
                //|        |                         | options (if ihl > 5)                                              |                     |
                //| 0x0022 | CD 67 01 BB E9 DF 53 5D | data                                                              |                     |
                //| 0x002A | 91 1F 42 06 50 10 40 3D |                                                                   |                     |
                //| 0x0032 | FF 81 00 00 00          |                                                                   |                     |
                //------------------------------------------------------------------------------------------------------------------------------

                //if (ip.Tcp != null && ip.Tcp.Http.Version == null)
                //    return;

                PrintPacketInfos(ppacket);
                _dataLength = (ushort)ppacket.Packet.Count;
                _dataEnum = ppacket.Packet.zAsEnumerableWithCounter();
                PrintEthernet(ppacket);

                EthernetDatagram ethernet = ppacket.Packet.Ethernet;
                if (ethernet.EtherType == EthernetType.IpV4)
                {
                    PrintIpV4(ppacket);
                    IpV4Datagram ip = ethernet.IpV4;
                    if (ip.Protocol == IpV4Protocol.Tcp)
                    {
                        PrintTcp(ppacket);
                        if (ip.Tcp.Http.Version != null)
                            PrintHttp(ppacket);
                    }
                }
                WriteSeparation();
                Trace.WriteLine();


            //}
            //finally
            //{
            //    WriteSeparation();
            //    Trace.WriteLine();
            //}
        }