public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
//same as for Ethernet2Packet.cs
if (includeSelfReference)
{
yield return(this);
}
if (PacketStartIndex + this.protocolStartOffset < PacketEndIndex)
{
AbstractPacket packet;
if (this.protocol == IP_PROTOCOL_ID)
{
//IPv4 packet
packet = new IPv4Packet(this.ParentFrame, PacketStartIndex + this.protocolStartOffset, PacketEndIndex);
}
else
{
//something else
packet = new RawPacket(this.ParentFrame, PacketStartIndex + this.protocolStartOffset, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
//public static bool TryParse(Frame parentFrame, int packetStartIndex, int packetEndIndex, out AbstractPacket result) {
public static new bool TryParse(Frame parentFrame, int packetStartIndex, int packetEndIndex, out AbstractPacket result)
{
result = null;
try {
byte headerLength = (byte)(4 * (parentFrame.Data[packetStartIndex] & (byte)0x0F));
if ((parentFrame.Data.Length < packetStartIndex + 20))
{
return(false);
}
else if ((parentFrame.Data[packetStartIndex] >> 4) != 0x04 || headerLength < 20)
{
return(false);
}
else
{
ushort totalLength = Utils.ByteConverter.ToUInt16(parentFrame.Data, packetStartIndex + 2);
if (totalLength > MAX_JUMBO_FRAME_SIZE && totalLength > parentFrame.Data.Length)
{
return(false);
}
else
{
result = new IPv4Packet(parentFrame, packetStartIndex, packetEndIndex);
return(true);
}
}
}
catch {
return(false);
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
AbstractPacket packet = null;
try {
if (this.dsap == (byte)ServiceAccessPointType.SubNetworkAccessProtocol)
{
if (PacketStartIndex + 8 < PacketEndIndex)
{
if (this.etherType == (ushort)Ethernet2Packet.EtherTypes.IPv4)//IPv4
//packet=new IPv4Packet(this.ParentFrame, PacketStartIndex+8, PacketEndIndex);
{
IPv4Packet.TryParse(this.ParentFrame, PacketStartIndex + 8, PacketEndIndex, out packet);
}
else if (this.etherType == (ushort)Ethernet2Packet.EtherTypes.ARP)//ARP
//packet=new Ethernet2Packet(this.ParentFrame, PacketStartIndex+8, PacketEndIndex);
{
packet = new ArpPacket(this.ParentFrame, PacketStartIndex + 8, PacketEndIndex);
}
else
{
packet = new RawPacket(this.ParentFrame, PacketStartIndex + 8, PacketEndIndex);
}
}
}
else if (this.dsap == (byte)ServiceAccessPointType.HpExtendedLLC && this.etherType == (ushort)Ethernet2Packet.EtherTypes.HPSW)
{
if (PacketStartIndex + 10 < PacketEndIndex)
{
//skip HP Extended LLC positions...
packet = new HpSwitchProtocolPacket(this.ParentFrame, PacketStartIndex + 3 + 3 + 2 + 2, PacketEndIndex);
}
}
else //Not 802.2 SNAP or HPSW
{
if (PacketStartIndex + 3 < PacketEndIndex)
{
packet = new RawPacket(this.ParentFrame, PacketStartIndex + 3, PacketEndIndex);
}
}
}
catch (Exception e) {
//packet=new RawPacket(this.ParentFrame, PacketStartIndex+14, PacketEndIndex);
SharedUtils.Logger.Log("Exception when parsing inner packet of LLC: " + e.Message, SharedUtils.Logger.EventLogEntryType.Error);
packet = new RawPacket(this.ParentFrame, PacketStartIndex + 3, PacketEndIndex);
}
if (packet != null)
{
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
internal static AbstractPacket GetPacketForType(ushort etherType, Frame parentFrame, int newPacketStartIndex, int newPacketEndIndex)
{
AbstractPacket packet;
try {
//if(this.ParentFrame.Data[PacketStartIndex+12]==0x08 && this.ParentFrame.Data[PacketStartIndex+13]==0x00) {
if (etherType == (ushort)Ethernet2Packet.EtherTypes.IPv4 && IPv4Packet.TryParse(parentFrame, newPacketStartIndex, newPacketEndIndex, out packet))
{
//IPv4 packet
//packet = new IPv4Packet(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.IPv6)
{
//IPv6 packet
packet = new IPv6Packet(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
//else if(this.ParentFrame.Data[PacketStartIndex+12]==0x08 && this.ParentFrame.Data[PacketStartIndex+13]==0x06) {
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.ARP)
{
packet = new ArpPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
//ARP-packet
}
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.IEEE802_1Q)
{
//VLAN
packet = new IEEE_802_1Q_VlanPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.MPLS)
{
packet = new Mpls(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.PPPoE)
{
packet = new PointToPointOverEthernetPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
else if (etherType == (ushort)Ethernet2Packet.EtherTypes.xHayesTunnel)
{
packet = new Ethernet2Packet(parentFrame, newPacketStartIndex + 4, newPacketEndIndex);
}
//etherType might actually be a content length if it is an IEEE 802.3 packet
else if (etherType < 0x0600)
{
//the etherType showed to actually be a length value
packet = new LogicalLinkControlPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
else
{
//something else
packet = new RawPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
}
catch (Exception) {
packet = new RawPacket(parentFrame, newPacketStartIndex, newPacketEndIndex);
}
return(packet);
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
AbstractPacket packet = null;
int erfHeaderLength = 16;
if (this.extensionHeadersPresent)
{
erfHeaderLength += 4;//correct?
}
if (PacketStartIndex + 16 < PacketEndIndex)
{
if (type == (byte)RecordTypes.ERF_TYPE_ETH || type == (byte)RecordTypes.ERF_TYPE_COLOR_ETH || type == (byte)RecordTypes.ERF_TYPE_DSM_COLOR_ETH)
{
packet = new Ethernet2Packet(this.ParentFrame, this.PacketStartIndex + erfHeaderLength + 2, this.PacketEndIndex);
}
else if (type == (byte)RecordTypes.ERF_TYPE_IPV4)
{
IPv4Packet.TryParse(this.ParentFrame, this.PacketStartIndex + erfHeaderLength, this.PacketEndIndex, out packet);
//packet = new IPv4Packet(this.ParentFrame, this.PacketStartIndex + erfHeaderLength, this.PacketEndIndex);
}
else if (type == (byte)RecordTypes.ERF_TYPE_IPV6)
{
packet = new IPv6Packet(this.ParentFrame, this.PacketStartIndex + erfHeaderLength, this.PacketEndIndex);
}
else if (
type == (byte)RecordTypes.ERF_TYPE_HDLC_POS ||
type == (byte)RecordTypes.ERF_TYPE_COLOR_HDLC_POS ||
type == (byte)RecordTypes.ERF_TYPE_DSM_COLOR_HDLC_POS ||
type == (byte)RecordTypes.ERF_TYPE_COLOR_MC_HDLC_POS)
{
int firstByte = this.ParentFrame.Data[this.PacketStartIndex];
if (firstByte == 0x0f || firstByte == 0x8f)
{
packet = new CiscoHdlcPacket(this.ParentFrame, this.PacketStartIndex + erfHeaderLength, this.PacketEndIndex);
}
else
{
packet = new PointToPointPacket(this.ParentFrame, this.PacketStartIndex + erfHeaderLength, this.PacketEndIndex);
}
}
if (packet != null)
{
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
//same as for Ethernet2Packet.cs
if (includeSelfReference)
{
yield return(this);
}
if (PacketStartIndex + 16 < PacketEndIndex)
{
AbstractPacket packet;
if (this.protocol == (ushort)Ethernet2Packet.EtherTypes.IPv4 && IPv4Packet.TryParse(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex, out packet))
{
//IPv4 packet
//packet=new IPv4Packet(this.ParentFrame, PacketStartIndex+16, PacketEndIndex);
}
else if (this.protocol == (ushort)Ethernet2Packet.EtherTypes.IPv6)
{
//IPv6 packet
packet = new IPv6Packet(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
}
//else if(this.ParentFrame.Data[PacketStartIndex+12]==0x08 && this.ParentFrame.Data[PacketStartIndex+13]==0x06) {
else if (this.protocol == (ushort)Ethernet2Packet.EtherTypes.ARP)
{
packet = new ArpPacket(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
//ARP-packet
}
else if (this.protocol == (ushort)Ethernet2Packet.EtherTypes.IEEE802_1Q)
{
//VLAN
packet = new IEEE_802_1Q_VlanPacket(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
}
else if (this.protocol == (ushort)Ethernet2Packet.EtherTypes.PPPoE)
{
packet = new PointToPointOverEthernetPacket(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
}
//etherType might actually be a content length if it is an IEEE 802.3 packet
else if (this.protocol < 0x0600)
{
//the etherType showed to actually be a length value
packet = new LogicalLinkControlPacket(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
}
else
{
//something else
packet = new RawPacket(this.ParentFrame, PacketStartIndex + 16, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
AbstractPacket packet;
if (this.bottomOfStack)
{
/**
* EoMPLS = Ethernet over MPLS
* http://www.faqs.org/rfcs/rfc4448.html
* 0 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* |0 0 0 0| Reserved | Sequence Number |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*
* In the above diagram, the first 4 bits MUST be set to 0 to indicate
* PW data. The rest of the first 16 bits are reserved for future use.
* They MUST be set to 0 when transmitting, and MUST be ignored upon
* receipt.
**/
if (ParentFrame.Data[PacketStartIndex + PAYLOAD_OFFSET] < 0x10)
{
packet = new Ethernet2Packet(this.ParentFrame, PacketStartIndex + PAYLOAD_OFFSET + 4, PacketEndIndex);
}
else if (IPv4Packet.TryParse(this.ParentFrame, PacketStartIndex + PAYLOAD_OFFSET, PacketEndIndex, out packet))
{
//packet = new IPv4Packet(this.ParentFrame, PacketStartIndex + PAYLOAD_OFFSET, PacketEndIndex);
}
else
{
yield break;
}
}
else
{
packet = new Mpls(this.ParentFrame, PacketStartIndex + PAYLOAD_OFFSET, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
//throw new Exception("The method or operation is not implemented.");
if (includeSelfReference)
{
yield return(this);
}
if (PacketStartIndex + 4 < PacketEndIndex && this.protocolCode != null)//there is room for data
{
AbstractPacket packet;
//check the protocolCode
if (this.protocolCode.Value == (ushort)Ethernet2Packet.EtherTypes.IPv4)
{
packet = new IPv4Packet(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (this.protocolCode.Value == (ushort)Ethernet2Packet.EtherTypes.IPv6)
{
packet = new IPv6Packet(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (this.protocolCode.Value == (ushort)Ethernet2Packet.EtherTypes.ARP)//not sure if ARP packets are used inside cHDLC frames
{
packet = new ArpPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (this.protocolCode.Value == (ushort)Ethernet2Packet.EtherTypes.IEEE802_1Q)
{
//VLAN
packet = new IEEE_802_1Q_VlanPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (this.protocolCode.Value == (ushort)Ethernet2Packet.EtherTypes.PPPoE)
{
packet = new PointToPointOverEthernetPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else
{
//something else
packet = new RawPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
AbstractPacket packet = null;
if (this.protocolFamily == (uint)ProtocolFamily.AF_INET && IPv4Packet.TryParse(this.ParentFrame, this.PacketStartIndex + PACKET_LENGTH, this.PacketEndIndex, out packet))
{
//packet = new IPv4Packet(this.ParentFrame, this.PacketStartIndex + PACKET_LENGTH, this.PacketEndIndex);
}
else if (this.protocolFamily == (uint)ProtocolFamily.AF_INET6_OpenBSD)
{
packet = new IPv6Packet(this.ParentFrame, this.PacketStartIndex + PACKET_LENGTH, this.PacketEndIndex);
}
else if (this.protocolFamily == (uint)ProtocolFamily.AF_INET6_FreeBSD)
{
packet = new IPv6Packet(this.ParentFrame, this.PacketStartIndex + PACKET_LENGTH, this.PacketEndIndex);
}
else if (this.protocolFamily == (uint)ProtocolFamily.AF_INET6_OSX)
{
packet = new IPv6Packet(this.ParentFrame, this.PacketStartIndex + PACKET_LENGTH, this.PacketEndIndex);
}
if (packet == null)
{
yield break;
}
else
{
yield return(packet);
}
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
if (this.fragmentOffset != 0 || this.moreFragmentsFlag)
{
if (!this.ParentFrame.QuickParse)
{
byte[] reassembledIpFrameData = null;
string fragmentID = this.GetFragmentIdentifier();
lock (PacketHandler.Ipv4Fragments) {
List <IPv4Packet> ipPacketList;
if (!PacketHandler.Ipv4Fragments.ContainsKey(fragmentID))
{
ipPacketList = new List <IPv4Packet>();
PacketHandler.Ipv4Fragments.Add(fragmentID, ipPacketList);
}
else
{
ipPacketList = PacketHandler.Ipv4Fragments[fragmentID];
}
ipPacketList.Add(this);
//see if we have all fragments of a complete IP packet
bool allFragmentsHaveMoreFragmentsFlag = true;
int completeIpPacketPayloadLength = 0;
foreach (IPv4Packet p in ipPacketList)
{
completeIpPacketPayloadLength += p.PayloadLength;
if (!p.moreFragmentsFlag)
{
allFragmentsHaveMoreFragmentsFlag = false;
}
}
if (!allFragmentsHaveMoreFragmentsFlag)
{
//we might actually have all the fragments!
reassembledIpFrameData = new byte[this.HeaderLength + completeIpPacketPayloadLength];
if (reassembledIpFrameData.Length > UInt16.MaxValue)
{
PacketHandler.Ipv4Fragments.Remove(fragmentID);
yield break;
}
foreach (IPv4Packet p in ipPacketList)
{
if (p.fragmentOffset + this.HeaderLength + p.PayloadLength > reassembledIpFrameData.Length)
{
yield break;
}
Array.Copy(p.ParentFrame.Data, p.PacketStartIndex + p.HeaderLength, reassembledIpFrameData, p.fragmentOffset + this.HeaderLength, p.PayloadLength);
}
PacketHandler.Ipv4Fragments.Remove(fragmentID);//we don't want to reassemble this IP frame any more
//we now need to create a fake frame and run GetSubPackets(false) on it
}
}//Release lock on PacketHandler.Ipv4Fragments
if (reassembledIpFrameData != null && reassembledIpFrameData.Length > this.HeaderLength)
{
Array.Copy(this.ParentFrame.Data, this.PacketStartIndex, reassembledIpFrameData, 0, this.headerLength);
//totalLength = (ushort)reassembledIpFrameData.Length;
Utils.ByteConverter.ToByteArray((ushort)reassembledIpFrameData.Length, reassembledIpFrameData, 2);
//moreFragmentsFlag = false;
//fragmentOffset = 0;
reassembledIpFrameData[6] = 0;
reassembledIpFrameData[7] = 0;
Frame reassembledFrame = new Frame(this.ParentFrame.Timestamp, reassembledIpFrameData, ParentFrame.FrameNumber);
IPv4Packet reassembledIpPacket = new IPv4Packet(reassembledFrame, 0, reassembledFrame.Data.Length - 1);
reassembledIpPacket.fragmentOffset = 0;
reassembledIpPacket.moreFragmentsFlag = false;
reassembledIpPacket.totalLength = (ushort)reassembledIpFrameData.Length;
foreach (AbstractPacket subPacket in reassembledIpPacket.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
}
else if (PacketStartIndex + headerLength < PacketEndIndex && this.fragmentOffset == 0)
{
AbstractPacket packet;
try {
if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.TCP)
{
//TCP packet
if (PacketStartIndex + headerLength + 20 > PacketEndIndex + 1)
{
yield break;//too little room for a TCP packet
}
else
{
packet = new TcpPacket(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
}
else if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.UDP)
{
//UDP packet
if (PacketStartIndex + headerLength + 8 > PacketEndIndex + 1)
{
yield break;//too little room for a UDP packet
}
else
{
packet = new UdpPacket(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
}
else if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.SCTP)
{
//SCTP packet
packet = new SctpPacket(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
else if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.IPv6)
{
packet = new IPv6Packet(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
else if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.GRE)
{
packet = new GrePacket(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
else if (this.protocol == (byte)IPv4Packet.RFC1700Protocols.ICMP)
{
packet = new IcmpPacket(this.ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
else
{
packet = new RawPacket(ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
}
catch (Exception) {
packet = new RawPacket(ParentFrame, PacketStartIndex + headerLength, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
public static bool TryGetPacket(out Packets.AbstractPacket packet, System.Type packetType, Frame parentFrame, int startIndex, int endIndex)
{
packet = null;
try {
if (packetType.Equals(typeof(Packets.Ethernet2Packet)))
{
packet = new Packets.Ethernet2Packet(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.IPv4Packet)))
{
IPv4Packet.TryParse(parentFrame, startIndex, endIndex, out packet);
//packet = new Packets.IPv4Packet(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.IPv6Packet)))
{
packet = new Packets.IPv6Packet(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.TcpPacket)))
{
packet = new Packets.TcpPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.IEEE_802_11Packet)))
{
packet = new Packets.IEEE_802_11Packet(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.IEEE_802_11RadiotapPacket)))
{
packet = new Packets.IEEE_802_11RadiotapPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.CiscoHdlcPacket)))
{
packet = new Packets.CiscoHdlcPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.LinuxCookedCapture)))
{
packet = new Packets.LinuxCookedCapture(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.PrismCaptureHeaderPacket)))
{
packet = new Packets.PrismCaptureHeaderPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.PpiPacket)))
{
packet = new Packets.PpiPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.PointToPointPacket)))
{
packet = new Packets.PointToPointPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.NullLoopbackPacket)))
{
packet = new Packets.NullLoopbackPacket(parentFrame, startIndex, endIndex);
}
else if (packetType.Equals(typeof(Packets.ErfFrame)))
{
packet = new Packets.ErfFrame(parentFrame, startIndex, endIndex);
}
if (packet == null)
{
return(false);
}
else
{
return(true);
}
}
catch (Exception) {
packet = new Packets.RawPacket(parentFrame, startIndex, endIndex);
return(false);
}
}