public IPv4Packet CreateIPv4Packet(EthernetPacket ethernetHeader)
{
int ipv4PacketTotalLength = Int32.Parse(textBoxTotalLength.Text);
byte[] bytes = new byte[EthernetFields_Fields.ETH_HEADER_LEN + ipv4PacketTotalLength];
IPv4Packet ipv4Packet = new IPv4Packet(
EthernetFields_Fields.ETH_HEADER_LEN,
bytes);
// Ethernet fields
ipv4Packet.EthernetHeader = ethernetHeader.Bytes;
// IP fields
ipv4Packet.Version = 4;
ipv4Packet.IPHeaderLength = IPv4Fields_Fields.IP_HEADER_LEN;
ipv4Packet.TypeOfService = Int32.Parse(textBoxDS.Text);
ipv4Packet.IPTotalLength = ipv4PacketTotalLength;
ipv4Packet.Id = 0;
ipv4Packet.FragmentFlags = Int32.Parse(textBoxFlags.Text);
ipv4Packet.FragmentOffset = 0;
ipv4Packet.TimeToLive = Int32.Parse(textBoxTTL.Text);
ipv4Packet.IPProtocol = (IPProtocol.IPProtocolType)((DictionaryEntry)comboBoxIPProtocols.SelectedItem).Key;
ipv4Packet.SourceAddress = IPAddress.Parse(textBoxSourceAddress.Text);
ipv4Packet.DestinationAddress = IPAddress.Parse(textBoxDestinationAddress.Text);
ipv4Packet.ComputeIPChecksum(true);
ipv4Packet.IPData = GetRandomPacketData(ipv4Packet.IPPayloadLength);
return ipv4Packet;
}
public EthernetPacket CreateEthernetPacket(int payloadLength)
{
byte[] payload = null;
if (payloadLength > 0)
{
payload = GetRandomPacketData(payloadLength);
}
EthernetPacket packet = new EthernetPacket(
PhysicalAddress.Parse(textBoxSourceHwAddress.Text),
PhysicalAddress.Parse(textBoxDestinationHwAddress.Text),
(EthernetPacketType)((DictionaryEntry)comboBoxEthernetProtocols.SelectedItem).Key,
payload);
return packet;
}
/// <summary> Convert captured packet data into an object.</summary>
public static Packet dataToPacket(LinkLayers linkType, byte[] bytes, Timeval tv)
{
EthernetPacketType ethProtocol;
// retrieve the length of the headers associated with this link layer type.
// this length is the offset to the header embedded in the packet.
int byteOffsetToEthernetPayload = LinkLayer.LinkLayerLength(linkType);
// extract the protocol code for the type of header embedded in the
// link-layer of the packet
int offset = LinkLayer.ProtocolOffset(linkType);
if (offset == -1)
{
// if there is no embedded protocol, assume IpV4
ethProtocol = EthernetPacketType.IPv4;
}
else
{
ethProtocol = (EthernetPacketType)ArrayHelper.extractInteger(bytes, offset, EthernetFields_Fields.ETH_CODE_LEN);
}
string errorString;
Packet parsedPacket = null;
try
{
// try to recognize the ethernet type..
switch (ethProtocol)
{
// arp
case EthernetPacketType.ARP:
parsedPacket = new ARPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case EthernetPacketType.IPv6:
case EthernetPacketType.IPv4:
try
{
// ethernet level code is recognized as IP, figure out what kind..
int ipProtocol = IPProtocol.extractProtocol(byteOffsetToEthernetPayload, bytes);
switch (ipProtocol)
{
case (int)IPProtocol.IPProtocolType.ICMP:
parsedPacket = new ICMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.IGMP:
parsedPacket = new IGMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.TCP:
parsedPacket = new TCPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.UDP:
parsedPacket = new UDPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
// unidentified ip..
default:
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return parsedPacket;
}
}
catch
{
// error parsing the specific ip packet type, parse as a generic IPPacket
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return parsedPacket;
}
}
// ethernet level code not recognized, default to anonymous packet..
default:
parsedPacket = new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
return parsedPacket;
}
catch
{
// we know we have at least an ethernet packet, so return that
return new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv);
}
}
public ScanMessage Connect(IPEndPoint ipEndPoint)
{
// SYN packet creation
//MAC address of gateway is provided by arp protocol
ARP arper = new ARP(device.Name);
arper.LocalIP = device.Interface.Addresses[0].Addr.ipAddress;
arper.LocalMAC = device.Interface.MacAddress;
PhysicalAddress gatewayHwAddress = arper.Resolve(gatewayAddress);
EthernetPacket ethernetHeader = new EthernetPacket(
device.Interface.MacAddress,
gatewayHwAddress,
EthernetPacketType.IPv4,
null);
byte[] content = new byte[
EthernetFields_Fields.ETH_HEADER_LEN +
IPv4Fields_Fields.IP_HEADER_LEN +
TCPFields_Fields.TCP_HEADER_LEN];
IPv4Packet ipv4Packet = new IPv4Packet(
EthernetFields_Fields.ETH_HEADER_LEN,
content);
// Ethernet header
ipv4Packet.EthernetHeader = ethernetHeader.Bytes;
// IP fields
ipv4Packet.Version = 4;
ipv4Packet.IPHeaderLength = IPv4Fields_Fields.IP_HEADER_LEN;
ipv4Packet.IPTotalLength = content.Length - EthernetFields_Fields.ETH_HEADER_LEN;
ipv4Packet.Id = 100;
ipv4Packet.TimeToLive = 20;
ipv4Packet.IPProtocol = IPProtocol.IPProtocolType.TCP;
ipv4Packet.SourceAddress = device.Interface.Addresses[0].Addr.ipAddress;
ipv4Packet.DestinationAddress = ipEndPoint.Address;
ipv4Packet.ComputeIPChecksum(true);
TCPPacket tcpPacket = new TCPPacket(
EthernetFields_Fields.ETH_HEADER_LEN,
content);
// TCP fields
tcpPacket.SourcePort = 2222;
tcpPacket.DestinationPort = ipEndPoint.Port;
tcpPacket.SequenceNumber = 1000;
tcpPacket.AcknowledgmentNumber = 1000;
tcpPacket.Syn = true;
tcpPacket.TCPHeaderLength = TCPFields_Fields.TCP_HEADER_LEN;
tcpPacket.WindowSize = 555;
// Calculate checksum
tcpPacket.ComputeTCPChecksum(true);
try
{
device.Open(false, 20);
device.SetFilter(String.Format("ip src {0} and tcp src port {1} and tcp dst port {2}",
tcpPacket.DestinationAddress,
tcpPacket.DestinationPort,
tcpPacket.SourcePort));
// Send the packet
device.SendPacket(tcpPacket);
TCPPacket replyPacket = null;
bool replyReceived = false;
Stopwatch watch = new Stopwatch();
watch.Start();
// Condition including timeout check.
while (watch.ElapsedMilliseconds < timeout && replyReceived != true)
{
if ((replyPacket = (TCPPacket)device.GetNextPacket()) != null)
{
replyReceived = true;
}
}
if (!replyReceived) // A reply hasn't been received
{
return ScanMessage.Timeout;
}
else if (replyPacket.Rst) // Remote host reset the connection
{
return ScanMessage.PortClosed;
}
else if (replyPacket.Ack) // Remote host replied with a TCP packet
{
tcpPacket.Syn = false;
tcpPacket.Rst = true;
tcpPacket.WindowSize = 0;
tcpPacket.ComputeTCPChecksum(true);
device.SendPacket(tcpPacket);
return ScanMessage.PortOpened;
}
else
{
return ScanMessage.Unknown;
}
}
catch (Exception)
{
return ScanMessage.Unknown;
}
finally
{
device.Close();
}
}
public IPPacket(IPVersions ipVersion,
IPProtocol.IPProtocolType ipProtocolType,
IPAddress sourceAddress,
IPAddress destinationAddress,
EthernetPacket ethernetPacket,
byte[] ipPacketPayload)
: base(EthernetFields_Fields.ETH_HEADER_LEN, null)
{
// determine how many bytes we need for this packet
int ipHeaderLength = ((ipVersion == IPVersions.IPv4) ? IPv4Fields_Fields.IP_HEADER_LEN : IPv6Fields_Fields.IPv6_HEADER_LEN);
int ipPayloadLength = (ipPacketPayload != null) ? ipPacketPayload.Length : 0;
int totalBytesRequired = 0;
totalBytesRequired += EthernetFields_Fields.ETH_HEADER_LEN;
totalBytesRequired += ipHeaderLength;
totalBytesRequired += ipPayloadLength;
// copy the ethernet packet header into the byte array
byte[] bytes = new Byte[totalBytesRequired];
Array.Copy(ethernetPacket.EthernetHeader, bytes, ethernetPacket.EthernetHeader.Length);
// set the packet bytes to our new, correct length
// buffer
//
// NOTE: we cannot say: Bytes = bytes; because
// the Bytes set property results in a call to
// InitIPPacket with a parameter of IPVersion which
// would result in the version being retrieved from
// an offset into the byte array but we haven't
// set the version in the byte array yet by setting
// this.IPVersion to a value
base.Bytes = bytes;
// call InitIPPacket to instantiate a packet of the proper type
InitIPPacket(ipVersion);
// set the header length to the default value for our ip version
IPHeaderLength = ipHeaderLength;
// set the EthernetPacket type to the proper ip version
base.EthernetProtocol = (ipVersion == IPVersions.IPv4) ? EthernetPacketType.IPv4 : EthernetPacketType.IPv6;
// set the ip protocol type
this.IPProtocol = ipProtocolType;
// set the current instance to the proper ip version
this.IPVersion = ipVersion;
// update the source and destination addresses
this.SourceAddress = sourceAddress;
this.DestinationAddress = destinationAddress;
// and set the payload to the payload that was passed in
if (ipPacketPayload != null)
{
Array.Copy(ipPacketPayload, 0, Bytes, _ipPayloadOffset, ipPacketPayload.Length);
IPPayloadLength = ipPacketPayload.Length;
}
else
{
IPPayloadLength = 0;
}
}
public IPPacket(IPVersions ipVersion,
IPProtocol.IPProtocolType ipProtocolType,
IPAddress sourceAddress,
IPAddress destinationAddress,
EthernetPacket ethernetPacket,
byte[] ipPacketPayload)
: base(EthernetFields_Fields.ETH_HEADER_LEN, null)
{
// determine how many bytes we need for this packet
int ipHeaderLength = ((ipVersion == IPVersions.IPv4) ? IPv4Fields_Fields.IP_HEADER_LEN : IPv6Fields_Fields.IPv6_HEADER_LEN);
int ipPayloadLength = (ipPacketPayload != null) ? ipPacketPayload.Length : 0;
int totalBytesRequired = 0;
totalBytesRequired += EthernetFields_Fields.ETH_HEADER_LEN;
totalBytesRequired += ipHeaderLength;
totalBytesRequired += ipPayloadLength;
// copy the ethernet packet header into the byte array
byte[] bytes = new Byte[totalBytesRequired];
Array.Copy(ethernetPacket.EthernetHeader, bytes, ethernetPacket.EthernetHeader.Length);
// set the packet bytes to our new, correct length
// buffer
//
// NOTE: we cannot say: Bytes = bytes; because
// the Bytes set property results in a call to
// InitIPPacket with a parameter of IPVersion which
// would result in the version being retrieved from
// an offset into the byte array but we haven't
// set the version in the byte array yet by setting
// this.IPVersion to a value
base.Bytes = bytes;
// call InitIPPacket to instantiate a packet of the proper type
InitIPPacket(ipVersion);
// set the header length to the default value for our ip version
IPHeaderLength = ipHeaderLength;
// set the EthernetPacket type to the proper ip version
base.EthernetProtocol = (ipVersion == IPVersions.IPv4) ? EthernetPacketType.IPv4 : EthernetPacketType.IPv6;
// set the ip protocol type
this.IPProtocol = ipProtocolType;
// set the current instance to the proper ip version
this.IPVersion = ipVersion;
// update the source and destination addresses
this.SourceAddress = sourceAddress;
this.DestinationAddress = destinationAddress;
// and set the payload to the payload that was passed in
if (ipPacketPayload != null)
{
Array.Copy(ipPacketPayload, 0, Bytes, _ipPayloadOffset, ipPacketPayload.Length);
IPPayloadLength = ipPacketPayload.Length;
}
else
{
IPPayloadLength = 0;
}
}
internal static void UpdateEthernetNode(TreeView treeView, EthernetPacket ethPacket)
{
TreeNode ethNode = treeView.Nodes["Ethernet"];
if (ethNode == null)
{
ethNode = AddEthernetNode(treeView);
}
ethNode.Text = String.Format("Ethernet II, Src: {0}, Dst: {1}", GetHyphenatedHwAddress(ethPacket.SourceHwAddress), GetHyphenatedHwAddress(ethPacket.DestinationHwAddress));
ethNode.Nodes["Destination"].Text = String.Format("Destination: {0}", GetHyphenatedHwAddress(ethPacket.DestinationHwAddress));
ethNode.Nodes["Source"].Text = String.Format("Source: {0}", GetHyphenatedHwAddress(ethPacket.SourceHwAddress));
ethNode.Nodes["Type"].Text = String.Format("Type: {0} (0x{1:X4})", DataStructures.GetEtherTypeDescription(ethPacket.EthernetProtocol), (int)ethPacket.EthernetProtocol);
}
/// <summary> Convert captured packet data into an object.</summary>
public static Packet dataToPacket(LinkLayers linkType, byte[] bytes, Timeval tv)
{
EthernetPacketType ethProtocol;
// retrieve the length of the headers associated with this link layer type.
// this length is the offset to the header embedded in the packet.
int byteOffsetToEthernetPayload = LinkLayer.LinkLayerLength(linkType);
// extract the protocol code for the type of header embedded in the
// link-layer of the packet
int offset = LinkLayer.ProtocolOffset(linkType);
if (offset == -1)
{
// if there is no embedded protocol, assume IpV4
ethProtocol = EthernetPacketType.IPv4;
}
else
{
ethProtocol = (EthernetPacketType)ArrayHelper.extractInteger(bytes, offset, EthernetFields_Fields.ETH_CODE_LEN);
}
string errorString;
Packet parsedPacket = null;
try
{
// try to recognize the ethernet type..
switch (ethProtocol)
{
// arp
case EthernetPacketType.ARP:
parsedPacket = new ARPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case EthernetPacketType.IPv6:
case EthernetPacketType.IPv4:
try
{
// ethernet level code is recognized as IP, figure out what kind..
int ipProtocol = IPProtocol.extractProtocol(byteOffsetToEthernetPayload, bytes);
switch (ipProtocol)
{
case (int)IPProtocol.IPProtocolType.ICMP:
parsedPacket = new ICMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.IGMP:
parsedPacket = new IGMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.TCP:
parsedPacket = new TCPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.UDP:
parsedPacket = new UDPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
// unidentified ip..
default:
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return(parsedPacket);
}
}
catch
{
// error parsing the specific ip packet type, parse as a generic IPPacket
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return(parsedPacket);
}
}
// ethernet level code not recognized, default to anonymous packet..
default:
parsedPacket = new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
return(parsedPacket);
}
catch
{
// we know we have at least an ethernet packet, so return that
return(new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv));
}
}
