public void Test_Constructor_ConstructWithValues()
{
InformationElement ssidInfoElement = new InformationElement(InformationElement.ElementId.ServiceSetIdentity,
new Byte[] { 0x68, 0x65, 0x6c, 0x6c, 0x6f });
InformationElement vendorElement = new InformationElement(InformationElement.ElementId.VendorSpecific,
new Byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 });
ProbeResponseFrame frame = new ProbeResponseFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"),
PhysicalAddress.Parse("333333333333"),
new InformationElementList()
{
ssidInfoElement, vendorElement
});
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.Duration.Field = 0x1234;
frame.SequenceControl.SequenceNumber = 0x77;
frame.SequenceControl.FragmentNumber = 0x1;
frame.CapabilityInformation.IsEss = true;
frame.CapabilityInformation.ChannelAgility = true;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
ProbeResponseFrame recreatedFrame = MacFrame.ParsePacket(bas) as ProbeResponseFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ManagementProbeResponse, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x77, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.IsTrue(frame.CapabilityInformation.IsEss);
Assert.IsTrue(frame.CapabilityInformation.ChannelAgility);
Assert.AreEqual("111111111111", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
Assert.AreEqual(ssidInfoElement, recreatedFrame.InformationElements [0]);
Assert.AreEqual(vendorElement, recreatedFrame.InformationElements [1]);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void AddUnknownField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_multiplefields.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
PpiUnknown unknownField = new PpiUnknown(99, new Byte[] { 0xAA, 0xBB, 0xCC, 0xDD });
p.Add(unknownField);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, p.Bytes) as PpiPacket;
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiCommon));
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiMacPhy));
Assert.IsTrue(recreatedPacket.Contains((PpiFieldType)99));
PpiUnknown recreatedUnknownField = recreatedPacket.FindFirstByType((PpiFieldType)99) as PpiUnknown;
Assert.AreEqual(new Byte[] { 0xAA, 0xBB, 0xCC, 0xDD }, recreatedUnknownField.UnknownBytes);
MacFrame macFrame = recreatedPacket.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.FCSValid);
}
// 获取设备的 MAC 地址，如果是 AP 则返回 Null
public string GetWlanSa(CaptureEventArgs e)
{
var p = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
MacFrame macFrame = (MacFrame)p.PayloadPacket;
if (macFrame != null) // 只拉取 802.11 的 MAC 帧
{
if (macFrame.FrameControl.SubType == FrameControlField.FrameSubTypes.ManagementProbeRequest) // 如果是设备请求 AP 列表
{
ProbeRequestFrame probeReqFrame = (ProbeRequestFrame)macFrame;
macaddr = probeReqFrame.SourceAddress.ToString();
valid = true;
}
else if (macFrame.FrameControl.SubType == FrameControlField.FrameSubTypes.DataNullFunctionNoData) // 如果是设备发送心跳
{
NullDataFrame nullDataFrame = (NullDataFrame)macFrame;
macaddr = nullDataFrame.SourceAddress.ToString();
valid = true;
}
}
if (valid) // 格式化 MAC 地址
{
macaddr = Regex.Replace(macaddr, @"^(..)(..)(..)(..)(..)(..)$", "$1-$2-$3-$4-$5-$6");
}
else
{
return(null); //是 AP 则返回 Null
}
return(macaddr);
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload, FlagsRadioTapField flagsField)
{
var payloadPacketOrData = new PacketOrByteArraySegment();
MacFrame frame = null;
if (flagsField != null)
{
bool fcsPresent = ((flagsField.Flags & RadioTapFlags.FcsIncludedInFrame) == RadioTapFlags.FcsIncludedInFrame);
if (fcsPresent)
{
frame = MacFrame.ParsePacketWithFcs(payload);
}
else
{
frame = MacFrame.ParsePacket(payload);
}
}
else
{
frame = MacFrame.ParsePacket(payload);
}
if (frame == null)
{
payloadPacketOrData.TheByteArraySegment = payload;
}
else
{
payloadPacketOrData.ThePacket = frame;
}
return(payloadPacketOrData);
}
/// <summary>Parse bytes into a packet</summary>
/// <param name="LinkLayer">
/// A <see cref="T:PacketDotNet.LinkLayers" /></param>
/// <param name="PacketData">
/// A <see cref="T:System.Byte" /></param>
/// <returns>
/// A <see cref="T:PacketDotNet.Packet" /></returns>
public static Packet ParsePacket(LinkLayers LinkLayer, byte[] PacketData)
{
ByteArraySegment bas = new ByteArraySegment(PacketData);
switch (LinkLayer)
{
case LinkLayers.Ethernet:
return((Packet) new EthernetPacket(bas));
case LinkLayers.Ppp:
return((Packet) new PPPPacket(bas));
case LinkLayers.Ieee80211:
return((Packet)MacFrame.ParsePacket(bas));
case LinkLayers.LinuxSLL:
return((Packet) new LinuxSLLPacket(bas));
case LinkLayers.Ieee80211_Radio:
return((Packet) new RadioPacket(bas));
case LinkLayers.PerPacketInformation:
return((Packet) new PpiPacket(bas));
default:
throw new NotImplementedException("LinkLayer of " + (object)LinkLayer + " is not implemented");
}
}
public void Test_Constructor_ConstructWithValues()
{
AckFrame frame = new AckFrame(PhysicalAddress.Parse("111111111111"));
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.Duration.Field = 0x1234;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
AckFrame recreatedFrame = MacFrame.ParsePacket(bas) as AckFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlACK, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual("111111111111", recreatedFrame.ReceiverAddress.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
/// <summary>
/// Parses the <see cref="Kavprot.Packets.Utils.ByteArraySegment"/> into a MacFrame.
/// </summary>
/// <returns>
/// The parsed MacFrame or null if it could not be parsed.
/// </returns>
/// <param name='bas'>
/// The bytes of the packet. bas.Offset should point to the first byte in the mac frame.
/// </param>
/// <remarks>If the provided bytes dont contain the FCS then call <see cref="MacFrame.ParsePacket"/> instead. The presence of the
/// FCS is usually determined by configuration of the device used to capture the packets.</remarks>
public static MacFrame ParsePacketWithFcs(ByteArraySegment bas)
{
if (bas.Length < (MacFields.FrameControlLength + MacFields.FrameCheckSequenceLength))
{
//There isn't enough data for there to be an FCS and a packet
return(null);
}
//remove the FCS from the buffer that we will pass to the packet parsers
ByteArraySegment basWithoutFcs = new ByteArraySegment(bas.Bytes,
bas.Offset,
bas.Length - MacFields.FrameCheckSequenceLength,
bas.BytesLength - MacFields.FrameCheckSequenceLength);
UInt32 fcs = EndianBitConverter.Big.ToUInt32(bas.Bytes,
(bas.Offset + bas.Length) - MacFields.FrameCheckSequenceLength);
MacFrame frame = ParsePacket(basWithoutFcs);
if (frame != null)
{
frame.AppendFcs = true;
frame.FrameCheckSequence = fcs;
}
return(frame);
}
public void ReadPacketWithNoFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_radio_without_fcs.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
RadioPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as RadioPacket;
Assert.IsNotNull(p.PayloadPacket);
TsftRadioTapField tsftField = p[RadioTapType.Tsft] as TsftRadioTapField;
Assert.IsNotNull(tsftField);
Assert.AreEqual(38724775, tsftField.TimestampUsec);
FlagsRadioTapField flagsField = p[RadioTapType.Flags] as FlagsRadioTapField;
Assert.IsNotNull(flagsField);
Assert.AreEqual(0, (Int32)flagsField.Flags);
RateRadioTapField rateField = p[RadioTapType.Rate] as RateRadioTapField;
Assert.IsNotNull(rateField);
Assert.AreEqual(1, rateField.RateMbps);
ChannelRadioTapField channelField = p[RadioTapType.Channel] as ChannelRadioTapField;
Assert.IsNotNull(channelField);
Assert.AreEqual(2462, channelField.FrequencyMHz);
Assert.AreEqual(11, channelField.Channel);
Assert.AreEqual(RadioTapChannelFlags.Channel2Ghz | RadioTapChannelFlags.Cck, channelField.Flags);
DbmAntennaSignalRadioTapField dbmSignalField = p[RadioTapType.DbmAntennaSignal] as DbmAntennaSignalRadioTapField;
Assert.IsNotNull(dbmSignalField);
Assert.AreEqual(-61, dbmSignalField.AntennaSignalDbm);
DbmAntennaNoiseRadioTapField dbmNoiseField = p[RadioTapType.DbmAntennaNoise] as DbmAntennaNoiseRadioTapField;
Assert.IsNotNull(dbmNoiseField);
Assert.AreEqual(-84, dbmNoiseField.AntennaNoisedBm);
AntennaRadioTapField antennaField = p[RadioTapType.Antenna] as AntennaRadioTapField;
Assert.IsNotNull(antennaField);
Assert.AreEqual(0, antennaField.Antenna);
DbAntennaSignalRadioTapField dbSignalField = p[RadioTapType.DbAntennaSignal] as DbAntennaSignalRadioTapField;
Assert.IsNotNull(dbSignalField);
Assert.AreEqual(23, dbSignalField.SignalStrengthdB);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.IsFalse(macFrame.AppendFcs);
Assert.IsFalse(macFrame.FCSValid);
}
public void ReadingPacketsFromFile()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_plus_radiotap_header.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
RadioPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as RadioPacket;
Assert.IsNotNull(p);
Assert.IsNotNull(p[RadioTapType.Flags]);
Assert.IsNotNull(p[RadioTapType.Rate]);
Assert.IsNotNull(p[RadioTapType.Channel]);
Assert.IsNotNull(p[RadioTapType.DbmAntennaSignal]);
Assert.IsNotNull(p[RadioTapType.DbmAntennaNoise]);
Assert.IsNotNull(p[RadioTapType.LockQuality]);
Assert.IsNotNull(p[RadioTapType.Antenna]);
Assert.IsNotNull(p[RadioTapType.DbAntennaSignal]);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.AppendFcs);
}
public void MacFrameGetDataSample()
{
MacFrame frame = new MacFrame();
frame.Ctrl.FrameType = EmMacFrameType.Beacon;
frame.Ctrl.HasExtension = false;
frame.Ctrl.TargetAddrMode = EmAddrLen.Six;
frame.Ctrl.SourceAddrMode = EmAddrLen.Six;
frame.Seq.Value = 0;
frame.PanID = 0xffff;
frame.TargetAddr.Value = new byte[] { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
frame.SourceAddr.Value = new byte[] { 0x11, 0x11, 0x11, 0x11, 0x11, 0x12 };
MacBeacon mb = new MacBeacon();
mb.SendRandomTimeDelay = 97;
mb.BeaconRounds = 1;
mb.TSNo = 14;
mb.LevelNo = 1;
mb.BeaconID = 0xE1;
mb.NetworkSize = 26;
mb.StrengthLimit = 96;
mb.PanID = 0xffff;
mb.PanIDAddr = new byte[] { 0x88, 0x88, 0x88, 0x88, 0x88, 0x88 };
frame.Du = mb;
byte[] data = frame.GetData();
string str = String.Join(" ", data.Select(o => o.ToString("X2")));
}
public void Test_Constructor_ConstructWithValues()
{
var frame = new ContentionFreeEndFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"))
{
FrameControl = { ToDS = false, FromDS = true, MoreFragments = true },
Duration = { Field = 0x1234 }
};
frame.UpdateFrameCheckSequence();
var fcs = frame.FrameCheckSequence;
var bytes = frame.Bytes;
var byteArraySegment = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
var recreatedFrame = MacFrame.ParsePacket(byteArraySegment) as ContentionFreeEndFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlCFEnd, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x1234, recreatedFrame.Duration.Field);
Assert.AreEqual("111111111111", recreatedFrame.ReceiverAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.BssId.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void RemoveField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_multiplefields.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
var expectedLength = p.Length - p[1].Length - PpiHeaderFields.FieldHeaderLength;
p.Remove(p[1]);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, p.Bytes) as PpiPacket;
Assert.AreEqual(expectedLength, recreatedPacket.Length);
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiCommon));
Assert.IsFalse(recreatedPacket.Contains(PpiFieldType.PpiMacPhy));
MacFrame macFrame = recreatedPacket.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.FCSValid);
}
public void ReadingPacketsFromFile()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_per_packet_information.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
Assert.IsNotNull(p);
Assert.AreEqual(0, p.Version);
Assert.AreEqual(32, p.Length);
Assert.AreEqual(1, p.Count);
PpiCommon commonField = p.FindFirstByType(PpiFieldType.PpiCommon) as PpiCommon;
Assert.AreEqual(PpiFieldType.PpiCommon, commonField.FieldType);
Assert.AreEqual(0, commonField.TSFTimer);
Assert.IsTrue((commonField.Flags & PpiCommon.CommonFlags.FcsIncludedInFrame) == PpiCommon.CommonFlags.FcsIncludedInFrame);
Assert.AreEqual(2, commonField.Rate);
Assert.AreEqual(2437, commonField.ChannelFrequency);
Assert.AreEqual(0x00A0, (Int32)commonField.ChannelFlags);
Assert.AreEqual(0, commonField.FhssHopset);
Assert.AreEqual(0, commonField.FhssPattern);
Assert.AreEqual(-84, commonField.AntennaSignalPower);
Assert.AreEqual(-100, commonField.AntennaSignalNoise);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlCTS, macFrame.FrameControl.SubType);
Assert.IsTrue(macFrame.AppendFcs);
}
public void Test_Constructor_ConstructWithValues()
{
InformationElement ssidInfoElement = new InformationElement(InformationElement.ElementId.ServiceSetIdentity,
new Byte[] { 0x68, 0x65, 0x6c, 0x6c, 0x6f });
InformationElement vendorElement = new InformationElement(InformationElement.ElementId.VendorSpecific,
new Byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 });
AuthenticationFrame frame = new AuthenticationFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"),
PhysicalAddress.Parse("333333333333"),
new InformationElementList()
{
ssidInfoElement, vendorElement
});
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.Duration.Field = 0x1234;
frame.SequenceControl.SequenceNumber = 0x77;
frame.SequenceControl.FragmentNumber = 0x1;
frame.AuthenticationAlgorithmNumber = 0x4444;
frame.AuthenticationAlgorithmTransactionSequenceNumber = 0x5555;
frame.StatusCode = AuthenticationStatusCode.Success;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
AuthenticationFrame recreatedFrame = MacFrame.ParsePacket(bas) as AuthenticationFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ManagementAuthentication, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x77, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual(0x4444, recreatedFrame.AuthenticationAlgorithmNumber);
Assert.AreEqual(0x5555, recreatedFrame.AuthenticationAlgorithmTransactionSequenceNumber);
Assert.AreEqual(AuthenticationStatusCode.Success, recreatedFrame.StatusCode);
Assert.AreEqual("111111111111", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_Constructor_ConstructWithValues()
{
var ssidInfoElement = new InformationElement(InformationElement.ElementId.ServiceSetIdentity,
new byte[] { 0x68, 0x65, 0x6c, 0x6c, 0x6f });
var vendorElement = new InformationElement(InformationElement.ElementId.VendorSpecific,
new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 });
var frame = new AssociationResponseFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"),
PhysicalAddress.Parse("333333333333"),
new InformationElementList {
ssidInfoElement, vendorElement
})
{
FrameControl = { ToDS = false, FromDS = true, MoreFragments = true },
Duration = { Field = 0x1234 },
SequenceControl = { SequenceNumber = 0x77, FragmentNumber = 0x1 },
CapabilityInformation = { Privacy = true, ChannelAgility = true },
StatusCode = AuthenticationStatusCode.Success,
AssociationId = 0x2
};
frame.UpdateFrameCheckSequence();
var fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var byteArraySegment = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
var recreatedFrame = MacFrame.ParsePacket(byteArraySegment) as AssociationResponseFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ManagementAssociationResponse, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x77, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.IsTrue(recreatedFrame.CapabilityInformation.Privacy);
Assert.IsTrue(recreatedFrame.CapabilityInformation.ChannelAgility);
Assert.AreEqual(AuthenticationStatusCode.Success, recreatedFrame.StatusCode);
Assert.AreEqual(0x2, recreatedFrame.AssociationId);
Assert.AreEqual("111111111111", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void MacFrameSetDataSample()
{
MacFrame frame = new MacFrame();
byte[] data = Tools.HexStrToByteArr("40 CD 00 FF FF FF FF FF FF FF FF 12 11 11 11 11 11 61 01 0E 04 E1 1A 00 60 FF FF 88 88 88 88 88 88", ' ');
frame.SetData(data);
MacFrame frame1 = new MacFrame();
byte[] data1 = Tools.HexStrToByteArr("41 CF 6E 71 67 22 11 11 11 11 11 88 88 88 88 88 88 0A 46 43 20 00 07 00 F4 03 4D B9 BC 11 11 11 11 11 11 88 88 88 88 88 88 D2 21 FC FF 22 11 11 11 11 11 02 00 00 FE FE FE FE 68 11 11 11 11 11 11 68 11 04 34 34 33 37 1D 16", ' ');
frame1.SetData(data1);
}
static void device_OnPacketArrival(object sender, CaptureEventArgs e)
{
MacFrame p = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data) as MacFrame;
if (p.FrameControl.SubType == FrameControlField.FrameSubTypes.ManagementProbeResponse)
{
ProbeResponseFrame probeResponse = p as ProbeResponseFrame;
if (probeResponse.DestinationAddress == adapterAddress)
{
Console.WriteLine(probeResponse.ToString());
}
}
}
public void Test_Constructor_ConstructWithValues()
{
QosDataFrame frame = new QosDataFrame();
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.FrameControl.Protected = true;
frame.SequenceControl.SequenceNumber = 0x89;
frame.SequenceControl.FragmentNumber = 0x1;
frame.Duration.Field = 0x1234;
frame.QosControl = 0x9876;
frame.DestinationAddress = PhysicalAddress.Parse("111111111111");
frame.SourceAddress = PhysicalAddress.Parse("222222222222");
frame.BssId = PhysicalAddress.Parse("333333333333");
frame.PayloadData = new Byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 };
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
QosDataFrame recreatedFrame = MacFrame.ParsePacket(bas) as QosDataFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.QosData, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x89, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual(0x9876, recreatedFrame.QosControl);
Assert.AreEqual("111111111111", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
CollectionAssert.AreEqual(new Byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 }, recreatedFrame.PayloadData);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_Constructor_ConstructWithValues()
{
Byte[] BlockAckBitmap = new Byte[] { 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8 };
BlockAcknowledgmentFrame frame = new BlockAcknowledgmentFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"),
BlockAckBitmap);
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.Duration.Field = 0x1234;
frame.BlockAcknowledgmentControl.Policy = BlockAcknowledgmentControlField.AcknowledgementPolicy.Delayed;
frame.BlockAcknowledgmentControl.Tid = 0xF;
frame.BlockAckStartingSequenceControl = 0x5678;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
BlockAcknowledgmentFrame recreatedFrame = MacFrame.ParsePacket(bas) as BlockAcknowledgmentFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlBlockAcknowledgment, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x1234, recreatedFrame.Duration.Field);
Assert.AreEqual(BlockAcknowledgmentControlField.AcknowledgementPolicy.Delayed,
recreatedFrame.BlockAcknowledgmentControl.Policy);
Assert.AreEqual(0xF, recreatedFrame.BlockAcknowledgmentControl.Tid);
Assert.IsTrue(recreatedFrame.BlockAcknowledgmentControl.CompressedBitmap);
Assert.AreEqual(0x5678, recreatedFrame.BlockAckStartingSequenceControl);
Assert.AreEqual("111111111111", recreatedFrame.TransmitterAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.ReceiverAddress.ToString().ToUpper());
CollectionAssert.AreEqual(BlockAckBitmap, recreatedFrame.BlockAckBitmap);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_AppendFcs_Raw80211WithoutFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_raw_without_fcs.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
//For this test we are just going to ignore the radio packet that precedes the data frame
Packet p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
MacFrame macFrame = p as MacFrame;
Assert.IsFalse(macFrame.AppendFcs);
}
public void RemoveRadioTapField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_plus_radiotap_header.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
RadioPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as RadioPacket;
Assert.IsNotNull(p);
Assert.IsNotNull(p[RadioTapType.Flags]);
Assert.IsNotNull(p[RadioTapType.Rate]);
Assert.IsNotNull(p[RadioTapType.Channel]);
Assert.IsNotNull(p[RadioTapType.DbmAntennaSignal]);
Assert.IsNotNull(p[RadioTapType.DbmAntennaNoise]);
Assert.IsNotNull(p[RadioTapType.LockQuality]);
Assert.IsNotNull(p[RadioTapType.Antenna]);
Assert.IsNotNull(p[RadioTapType.DbAntennaSignal]);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.AppendFcs);
Assert.IsTrue(macFrame.FCSValid);
//Now remove a couple of radio tap fields and check that it is still valid
p.Remove(RadioTapType.Rate);
p.Remove(RadioTapType.Antenna);
RadioPacket recreatedFrame = Packet.ParsePacket(rawCapture.LinkLayerType, p.Bytes) as RadioPacket;
Assert.IsNotNull(recreatedFrame);
Assert.IsNotNull(recreatedFrame[RadioTapType.Flags]);
Assert.IsNull(recreatedFrame[RadioTapType.Rate]);
Assert.IsNotNull(recreatedFrame[RadioTapType.Channel]);
Assert.IsNotNull(recreatedFrame[RadioTapType.DbmAntennaSignal]);
Assert.IsNotNull(recreatedFrame[RadioTapType.DbmAntennaNoise]);
Assert.IsNotNull(recreatedFrame[RadioTapType.LockQuality]);
Assert.IsNull(recreatedFrame[RadioTapType.Antenna]);
Assert.IsNotNull(recreatedFrame[RadioTapType.DbAntennaSignal]);
MacFrame recreatedMacFrame = p.PayloadPacket as MacFrame;
Assert.IsNotNull(recreatedMacFrame);
Assert.IsTrue(recreatedMacFrame.AppendFcs);
Assert.IsTrue(recreatedMacFrame.FCSValid);
}
public void TestConstructWithValues()
{
InformationElement ssidInfoElement = new InformationElement(InformationElement.ElementId.ServiceSetIdentity, new Byte[] { 0x68, 0x65, 0x6c, 0x6c, 0x6f });
BeaconFrame frame = new BeaconFrame(
PhysicalAddress.Parse("11-11-11-11-11-11"),
PhysicalAddress.Parse("22-22-22-22-22-22"),
new InformationElementList()
{
ssidInfoElement
});
frame.FrameControl.ToDS = true;
frame.FrameControl.Protected = true;
frame.Duration.Field = 12345;
frame.SequenceControl.SequenceNumber = 3;
frame.Timestamp = 123456789;
frame.BeaconInterval = 4444;
frame.CapabilityInformation.IsIbss = true;
frame.CapabilityInformation.Privacy = true;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
BeaconFrame recreatedFrame = MacFrame.ParsePacket(bas) as BeaconFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ManagementBeacon, recreatedFrame.FrameControl.SubType);
Assert.AreEqual(PhysicalAddress.Parse("11-11-11-11-11-11"), recreatedFrame.SourceAddress);
Assert.AreEqual(PhysicalAddress.Parse("FF-FF-FF-FF-FF-FF"), recreatedFrame.DestinationAddress);
Assert.AreEqual(PhysicalAddress.Parse("22-22-22-22-22-22"), recreatedFrame.BssId);
Assert.IsTrue(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.Protected);
Assert.AreEqual(12345, recreatedFrame.Duration.Field);
Assert.AreEqual(3, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(123456789, recreatedFrame.Timestamp);
Assert.AreEqual(4444, recreatedFrame.BeaconInterval);
Assert.AreEqual(ssidInfoElement, recreatedFrame.InformationElements [0]);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_AppendFcs_Raw80211WithFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_raw_with_fcs.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
//For this test we are just going to ignore the radio packet that precedes the data frame
Packet p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
MacFrame macFrame = p as MacFrame;
//When its raw 802.11 we cant tell if there is an FCS there so even though
//there is we still expect AppendFcs to be false.
Assert.IsFalse(macFrame.AppendFcs);
}
public void ReadPacketWithValidFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_fcs_present_and_valid.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
Assert.IsNotNull(p.PayloadPacket);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.IsTrue(macFrame.FCSValid);
Assert.IsTrue(macFrame.AppendFcs);
}
public void Test_Constructor_ConstructWithValues()
{
DeauthenticationFrame frame = new DeauthenticationFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"),
PhysicalAddress.Parse("333333333333"));
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.Duration.Field = 0x1234;
frame.SequenceControl.SequenceNumber = 0x77;
frame.SequenceControl.FragmentNumber = 0x1;
frame.Reason = ReasonCode.LeavingToRoam;
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
DeauthenticationFrame recreatedFrame = MacFrame.ParsePacket(bas) as DeauthenticationFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ManagementDeauthentication, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x1234, recreatedFrame.Duration.Field);
Assert.AreEqual(0x77, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual(ReasonCode.LeavingToRoam, recreatedFrame.Reason);
Assert.AreEqual("111111111111", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void MacFrameGetDataSample1()
{
MacFrame frame = new MacFrame();
frame.Ctrl.FrameType = EmMacFrameType.Data;
frame.Ctrl.HasExtension = true;
frame.Ctrl.TargetAddrMode = EmAddrLen.Six;
frame.Ctrl.SourceAddrMode = EmAddrLen.Six;
frame.Seq.Value = 110;
frame.PanID = 0x6771;
frame.TargetAddr.Value = new byte[] { 0x11, 0x11, 0x11, 0x11, 0x11, 0x22 };
frame.SourceAddr.Value = new byte[] { 0x88, 0x88, 0x88, 0x88, 0x88, 0x88 };
frame.Extension = new MacExtension();
frame.Extension.ExtLength = 10;
frame.Extension.ExtContent.Value = Tools.HexStrToByteArr("46 43 20 00 07 00 F4 03 4D B9", ' ');
NetFrame nf = new NetFrame();
nf.Ctrl.FrameType = EmNetFrameType.Data;
nf.Ctrl.RoutingInstruction = 1;
nf.Ctrl.TargetAddrMode = EmAddrLen.Six;
nf.Ctrl.SourceAddrMode = EmAddrLen.Six;
nf.TargetAddr.Value = new byte[] { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11 };
nf.SourceAddr.Value = new byte[] { 0x88, 0x88, 0x88, 0x88, 0x88, 0x88 };
nf.Seq.Value = 13;
nf.Radius = 2;
nf.RouteInfo.Add(new NetAddr()
{
AddrMode = EmAddrLen.Six, Value = new byte[] { 0x11, 0x11, 0x11, 0x11, 0x11, 0x22 }
});
frame.Du = nf;
ApsFrame af = new ApsFrame();
af.Fcd.Ftd = EmApsFcdFtd.Forward;
af.Fcd.Oei = 0;
af.Seq.Value = 2;
af.Dui = (byte)EmApsFcdFtdDti.Auto;
af.Du.Value = Tools.HexStrToByteArr("FE FE FE FE 68 11 11 11 11 11 11 68 11 04 34 34 33 37 1D 16", ' ');
nf.Du = af;
byte[] data = frame.GetData();
}
/// <summary>
/// Parse bytes into a packet
/// </summary>
/// <param name="linkLayer">
/// A <see cref="LinkLayers" />
/// </param>
/// <param name="packetData">
/// A <see cref="System.Byte" />
/// </param>
/// <returns>
/// A <see cref="Packet" />
/// </returns>
public static Packet ParsePacket(LinkLayers linkLayer, byte[] packetData)
{
Packet p;
var bas = new ByteArraySegment(packetData);
Log.DebugFormat("LinkLayer {0}", linkLayer);
switch (linkLayer)
{
case LinkLayers.Ethernet:
p = new EthernetPacket(bas);
break;
case LinkLayers.LinuxSLL:
p = new LinuxSLLPacket(bas);
break;
case LinkLayers.Ppp:
p = new PPPPacket(bas);
break;
case LinkLayers.Ieee80211:
p = MacFrame.ParsePacket(bas);
break;
case LinkLayers.Ieee80211_Radio:
p = new RadioPacket(bas);
break;
case LinkLayers.PerPacketInformation:
p = new PpiPacket(bas);
break;
//http://sourceforge.net/p/packetnet/patches/1/
case LinkLayers.Raw:
var ipVer = (packetData[0] & 0xf0) >> 4;
p = (ipVer == 4)? new IPv4Packet(bas) : new IPv6Packet(bas) as Packet;
break;
default:
throw new NotImplementedException("LinkLayer of " + linkLayer + " is not implemented");
}
return(p);
}
/// <summary>
/// Uses the information contained in a PacketDotNet packet to update the
/// network graph.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
public void HandlePacketArrived(object sender, PacketArrivedEventArgs e)
{
MacFrame frame = e.ArrivedPacket.Extract <MacFrame>();
switch (frame)
{
case DataFrame dataFrame:
HandleDataFrame(dataFrame);
break;
case ManagementFrame managementFrame:
break;
default:
break;
}
}
public void Test_Constructor_UnecryptedDataFrameFromValues()
{
var frame = new DataDataFrame
{
FrameControl = { ToDS = false, FromDS = true, MoreFragments = true },
SequenceControl = { SequenceNumber = 0x89, FragmentNumber = 0x1 },
Duration = { Field = 0x1234 },
DestinationAddress = PhysicalAddress.Parse("111111111111"),
SourceAddress = PhysicalAddress.Parse("222222222222"),
BssId = PhysicalAddress.Parse("333333333333"),
PayloadData = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 }
};
frame.UpdateFrameCheckSequence();
var fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var byteArraySegment = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
var recreatedFrame = MacFrame.ParsePacket(byteArraySegment) as DataDataFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.Data, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x89, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual("111111111111", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
CollectionAssert.AreEqual(new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 }, recreatedFrame.PayloadData);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_Constructor_ConstructWithValues()
{
var frame = new BlockAcknowledgmentRequestFrame(PhysicalAddress.Parse("111111111111"),
PhysicalAddress.Parse("222222222222"))
{
FrameControl = { ToDS = false, FromDS = true, MoreFragments = true },
Duration = { Field = 0x1234 },
BlockAcknowledgmentControl = { CompressedBitmap = true, Policy = BlockAcknowledgmentControlField.AcknowledgementPolicy.Delayed, Tid = 0xF },
BlockAckStartingSequenceControl = 0x5678
};
frame.UpdateFrameCheckSequence();
var fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var byteArraySegment = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
var recreatedFrame = MacFrame.ParsePacket(byteArraySegment) as BlockAcknowledgmentRequestFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlBlockAcknowledgmentRequest, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x1234, recreatedFrame.Duration.Field);
Assert.AreEqual(BlockAcknowledgmentControlField.AcknowledgementPolicy.Delayed,
recreatedFrame.BlockAcknowledgmentControl.Policy);
Assert.AreEqual(0xF, recreatedFrame.BlockAcknowledgmentControl.Tid);
Assert.IsTrue(recreatedFrame.BlockAcknowledgmentControl.CompressedBitmap);
Assert.AreEqual(0x5678, recreatedFrame.BlockAckStartingSequenceControl);
Assert.AreEqual("111111111111", recreatedFrame.TransmitterAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.ReceiverAddress.ToString().ToUpper());
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
