Esempio n. 1
0
        public void HandlePacket(PacketDotNet.TcpPacket tcpPacket)
        {
            var ipPacket = (PacketDotNet.IPPacket)tcpPacket.ParentPacket;

            var session = new TcpSession()
            {
                SourceIp        = ipPacket.SourceAddress.ToString(),
                SourcePort      = tcpPacket.SourcePort,
                DestinationIp   = ipPacket.DestinationAddress.ToString(),
                DestinationPort = tcpPacket.DestinationPort
            };

            if (!_sessions.ContainsKey(session))
            {
                TcpRecon recon = new TcpRecon();
                _sessions.Add(session, recon);
            }

            _sessions[session].ReassemblePacket(tcpPacket);

            // If the tcp packet contains FIN or ACK flags we can determine that the session
            // is terminated by means that no more data is about to be sent.
            if (IsLiveCapture)
            {
                if (tcpPacket.Flags == 17 || tcpPacket.Flags == 1)
                {
                    session.Data = _sessions[session].Data;

                    foreach (var currentTcpPacket in _sessions[session].packets)
                    {
                        var currentIpPacket = (PacketDotNet.IPPacket)currentTcpPacket.ParentPacket;

                        session.Packets.Add(new TcpPacket()
                        {
                            SourceIp        = currentIpPacket.SourceAddress.ToString(),
                            SourcePort      = currentTcpPacket.SourcePort,
                            DestinationIp   = currentIpPacket.DestinationAddress.ToString(),
                            DestinationPort = currentTcpPacket.DestinationPort,
                            Data            = currentTcpPacket.PayloadData
                        });
                    }

                    completedSessions.Add(session);
                    _sessions.Remove(session);
                }
            }
        }
Esempio n. 2
0
        public void HandlePacket(PacketDotNet.TcpPacket tcpPacket)
        {
            var session = new TcpSession()
            {
                SourceIp        = ((PacketDotNet.IPPacket)tcpPacket.ParentPacket).SourceAddress.ToString(),
                SourcePort      = tcpPacket.SourcePort,
                DestinationIp   = ((PacketDotNet.IPPacket)tcpPacket.ParentPacket).DestinationAddress.ToString(),
                DestinationPort = tcpPacket.DestinationPort
            };

            if (!_sessions.ContainsKey(session))
            {
                TcpRecon recon = new TcpRecon();
                _sessions.Add(session, recon);
            }

            _sessions[session].ReassemblePacket(tcpPacket);
        }