public static bool Parser(byte [] PacketData, ref int Index, ref ListViewItem LItem, ref string TypeInfo, ref uint PreviousHttpSequence, ref ushort LastTftpPort) { PACKET_LLC PLlc; bool IsSnap = false; try { PLlc.DSAP = PacketData[Index++]; PLlc.SSAP = PacketData[Index++]; IsSnap = (PLlc.DSAP == Const.LLC_TYPE_SNAP) && (PLlc.SSAP == Const.LLC_TYPE_SNAP) ? true : false; PLlc.ControlField = (ushort)PacketData[Index++]; if ((PLlc.ControlField & 0xfc) != Const.XDLC_U) { PLlc.ControlField *= 256; PLlc.ControlField += (ushort)PacketData[Index++]; } if (IsSnap) { PLlc.OrganizationCode = Function.Get3Bytes(PacketData, ref Index, Const.NORMAL); PLlc.ProtocolId = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); } LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "LLC"; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Logical link control protocol"; PLlc.OrganizationCode = 0; if (IsSnap) { switch (PLlc.OrganizationCode) { case Const.OUI_ENCAP_ETHER: case Const.OUI_CISCO_90: case Const.OUI_APPLE_ATALK: //capture_ethertype(etype, pd, offset+8, len, ld); //PacketETHERNET.Parser( PacketData , ref Index , ref LItem , ref PreviousHttpSequence , ref LastTftpPort ); break; case Const.OUI_CISCO: PacketCDP.Parser(PacketData, ref Index, ref LItem); break; default: break; } } else { // non-SNAP switch (PLlc.DSAP) { case Const.LLCSAP_IP: PacketINTERNET.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort); break; case Const.LLC_TYPE_NOVELL_NETWARE: TypeInfo = "IPX"; PacketIPX.Parser(PacketData, ref Index, ref LItem); break; case Const.LLC_TYPE_IBM_NETBIOS: TypeInfo = "NetBIOS"; PacketNETBIOS.Parser(PacketData, ref Index, ref LItem); break; case Const.LLC_TYPE_STP: PacketSTP.Parser(PacketData, ref Index, ref LItem); break; default: break; } } } catch { LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]"; return(false); } return(true); }
public static bool Parser(ref TreeNodeCollection mNode, byte [] PacketData, ref ListViewItem LItem, ref uint PreviousHttpSequence, ref ushort LastTftpPort) { TreeNode mNodex; string Tmp = ""; int Index = 0; PACKET_ETHERNET PEthernet; mNodex = new TreeNode(); mNodex.Text = "ETHERNET"; Function.SetPosition(ref mNodex, Index, Const.LENGTH_OF_ETHERNET, true); if ((Index + Const.LENGTH_OF_ETHERNET) > PacketData.Length) { mNode.Add(mNodex); Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp; return(false); } try { PEthernet.Destination = Function.GetMACAddress(PacketData, ref Index);; Tmp = "Destination : " + PEthernet.Destination; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PEthernet.Source = Function.GetMACAddress(PacketData, ref Index);; Tmp = "Source : " + PEthernet.Source; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PEthernet.Type = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); if (PEthernet.Type <= 1500) { Tmp = "Length : " + Function.ReFormatString(PEthernet.Type, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); } else { Tmp = "Type : " + Function.ReFormatString(PEthernet.Type, Const.GetETHERTYPEStr(PEthernet.Type)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); } LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ETHERNET"; LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PEthernet.Source; LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PEthernet.Destination; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Ethernet protocol"; mNode.Add(mNodex); if (PEthernet.Type <= 1500) { PacketLLC.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort); } else { switch (PEthernet.Type) { case Const.ETHERTYPE_PUP: break; case Const.ETHERTYPE_SPRITE: break; case Const.ETHERTYPE_NS: break; case Const.ETHERTYPE_TRAIL: break; case Const.ETHERTYPE_MOPDL: break; case Const.ETHERTYPE_MOPRC: break; case Const.ETHERTYPE_DN: break; case Const.ETHERTYPE_LAT: break; case Const.ETHERTYPE_SCA: break; case Const.ETHERTYPE_IP: PacketINTERNET.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort); break; case Const.ETHERTYPE_ARP: PacketARP.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_REVARP: break; case Const.ETHERTYPE_LANBRIDGE: break; case Const.ETHERTYPE_DECDNS: break; case Const.ETHERTYPE_DECDTS: break; case Const.ETHERTYPE_VEXP: break; case Const.ETHERTYPE_VPROD: break; case Const.ETHERTYPE_ATALK: break; case Const.ETHERTYPE_AARP: break; case Const.ETHERTYPE_8021Q: break; case Const.ETHERTYPE_IPX: PacketIPX.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_IPV6: break; case Const.ETHERTYPE_LOOPBACK: PacketLOOPBACK.Parser(ref mNode, PacketData, ref Index, ref LItem); break; } } } catch (Exception Ex) { mNode.Add(mNodex); Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; return(false); } return(true); }
public static bool Parser(ref TreeNodeCollection mNode, byte [] PacketData, ref int Index, ref ListViewItem LItem, ref uint PreviousHttpSequence, ref ushort LastTftpPort) { TreeNode mNodex; string Tmp = ""; PACKET_LLC PLlc; bool UNFrame, IsSnap = false; int kk = 0; mNodex = new TreeNode(); mNodex.Text = "LLC ( Logical Link Control Protocol )"; kk = Index; try { PLlc.DSAP = PacketData[Index++]; Tmp = "DSAP : " + Function.ReFormatString(PLlc.DSAP, GetLLCTypeString(PLlc.DSAP)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 1, 1, false); PLlc.SSAP = PacketData[Index++]; Tmp = "SSAP : " + Function.ReFormatString(PLlc.SSAP, GetLLCTypeString(PLlc.SSAP)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 1, 1, false); IsSnap = (PLlc.DSAP == Const.LLC_TYPE_SNAP) && (PLlc.SSAP == Const.LLC_TYPE_SNAP) ? true : false; PLlc.ControlField = (ushort)PacketData[Index++]; UNFrame = true; if ((PLlc.ControlField & Const.XDLC_U) != Const.XDLC_U) { PLlc.ControlField *= 256; PLlc.ControlField += (ushort)PacketData[Index++]; UNFrame = false; } Tmp = "Control Field : " + Function.ReFormatString(PLlc.ControlField, null); mNodex.Nodes.Add(Tmp); if (UNFrame) { Function.SetPosition(ref mNodex, Index - 1, 1, false); } else { Function.SetPosition(ref mNodex, Index - 2, 2, false); } PLlc.OrganizationCode = 0; if (IsSnap) { PLlc.OrganizationCode = Function.Get3Bytes(PacketData, ref Index, Const.NORMAL); Tmp = "Organization Code : " + Function.ReFormatString(PLlc.OrganizationCode, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 3, 3, false); PLlc.ProtocolId = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); Tmp = "Protocol Id : " + Function.ReFormatString(PLlc.ProtocolId, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); } LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "LLC"; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Logical link control protocol"; Function.SetPosition(ref mNodex, kk, Index - kk, true); mNode.Add(mNodex); if (IsSnap) { switch (PLlc.OrganizationCode) { case Const.OUI_ENCAP_ETHER: case Const.OUI_CISCO_90: case Const.OUI_APPLE_ATALK: //capture_ethertype(etype, pd, offset+8, len, ld); //PacketETHERNET.Parser( ref mNode , PacketData , ref LItem , ref PreviousHttpSequence , ref LastTftpPort ); break; case Const.OUI_CISCO: PacketCDP.Parser(ref mNode, PacketData, ref Index, ref LItem); break; default: break; } } else { // non-SNAP switch (PLlc.DSAP) { case Const.LLCSAP_IP: PacketINTERNET.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort); break; case Const.LLC_TYPE_NOVELL_NETWARE: PacketIPX.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.LLC_TYPE_IBM_NETBIOS: PacketNETBIOS.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.LLC_TYPE_STP: PacketSTP.Parser(ref mNode, PacketData, ref Index, ref LItem); break; default: break; } } } catch (Exception Ex) { mNode.Add(mNodex); Tmp = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed LLC packet. Remaining bytes don't fit an LLC packet. Possibly due to bad decoding ]"; return(false); } return(true); }
public static bool Parser(byte [] PacketData, ref ListViewItem LItem, ref string TypeInfo, ref uint PreviousHttpSequence, ref ushort LastTftpPort) { string Tmp = ""; int Index = 0; PACKET_ETHERNET PEthernet; if ((Index + Const.LENGTH_OF_ETHERNET) > PacketData.Length) { Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp; return(false); } try { PEthernet.Destination = Function.GetMACAddress(PacketData, ref Index);; PEthernet.Source = Function.GetMACAddress(PacketData, ref Index);; PEthernet.Type = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ETHERNET"; LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PEthernet.Source; LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PEthernet.Destination; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Ethernet protocol"; if (PEthernet.Type <= 1500) { PacketLLC.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort); } else { switch (PEthernet.Type) { case Const.ETHERTYPE_PUP: TypeInfo = "Other"; break; case Const.ETHERTYPE_SPRITE: TypeInfo = "Other"; break; case Const.ETHERTYPE_NS: TypeInfo = "Other"; break; case Const.ETHERTYPE_TRAIL: TypeInfo = "Other"; break; case Const.ETHERTYPE_MOPDL: TypeInfo = "Other"; break; case Const.ETHERTYPE_MOPRC: TypeInfo = "Other"; break; case Const.ETHERTYPE_DN: TypeInfo = "Other"; break; case Const.ETHERTYPE_LAT: TypeInfo = "Other"; break; case Const.ETHERTYPE_SCA: TypeInfo = "Other"; break; case Const.ETHERTYPE_IP: TypeInfo = "Other"; PacketINTERNET.Parser(PacketData, ref Index, ref LItem, ref TypeInfo, ref PreviousHttpSequence, ref LastTftpPort); break; case Const.ETHERTYPE_ARP: TypeInfo = "Other"; PacketARP.Parser(PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_REVARP: TypeInfo = "Other"; break; case Const.ETHERTYPE_LANBRIDGE: TypeInfo = "Other"; break; case Const.ETHERTYPE_DECDNS: TypeInfo = "Other"; break; case Const.ETHERTYPE_DECDTS: TypeInfo = "Other"; break; case Const.ETHERTYPE_VEXP: TypeInfo = "Other"; break; case Const.ETHERTYPE_VPROD: TypeInfo = "Other"; break; case Const.ETHERTYPE_ATALK: TypeInfo = "Other"; break; case Const.ETHERTYPE_AARP: TypeInfo = "Other"; break; case Const.ETHERTYPE_8021Q: TypeInfo = "Other"; break; case Const.ETHERTYPE_IPX: TypeInfo = "IPX"; PacketIPX.Parser(PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_IPV6: TypeInfo = "Other"; break; case Const.ETHERTYPE_LOOPBACK: TypeInfo = "Other"; PacketLOOPBACK.Parser(PacketData, ref Index, ref LItem); break; } } } catch { LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; return(false); } return(true); }