/// <summary> Convert captured packet data into an object.</summary>
public static Packet dataToPacket(int linkType, byte[] bytes, Timeval tv)
{
int ethProtocol;
// retrieve the length of the headers associated with this link layer type.
// this length is the offset to the header embedded in the packet.
int lLen = LinkLayer.getLinkLayerLength(linkType);
// extract the protocol code for the type of header embedded in the
// link-layer of the packet
int offset = LinkLayer.getProtoOffset(linkType);
if (offset == -1)
{
// if there is no embedded protocol, assume IP?
ethProtocol = EthernetPacket.EtherType.IP;
}
else
{
ethProtocol = ArrayHelper.extractInteger(bytes, offset, EthernetFields_Fields.ETH_CODE_LEN);
}
// try to recognize the ethernet type..
switch (ethProtocol)
{
// arp
case EthernetPacket.EtherType.ARP:
return(new ARPPacket(lLen, bytes, tv));
case EthernetPacket.EtherType.IPV6:
case EthernetPacket.EtherType.IP:
// ethernet level code is recognized as IP, figure out what kind..
int ipProtocol = IPProtocol.extractProtocol(lLen, bytes);
switch (ipProtocol)
{
case (int)IPProtocol.IPProtocolType.ICMP: return(new ICMPPacket(lLen, bytes, tv));
case (int)IPProtocol.IPProtocolType.IGMP: return(new IGMPPacket(lLen, bytes, tv));
case (int)IPProtocol.IPProtocolType.TCP: return(new TCPPacket(lLen, bytes, tv));
case (int)IPProtocol.IPProtocolType.UDP: return(new UDPPacket(lLen, bytes, tv));
// unidentified ip..
default:
return(new IPPacket(lLen, bytes, tv));
}
// ethernet level code not recognized, default to anonymous packet..
default:
return(new EthernetPacket(lLen, bytes, tv));
}
}
public static TCPPacket RandomPacket(int size, IPVersions ipver)
{
if (size < MinimumIPv4Bytes)
{
throw new Exception("Size should be at least " + MinimumIPv4Bytes + " (Eth + IP + TCP)");
}
if ((ipver == IPVersions.IPv6) && (size < MinimumIPv6Bytes))
{
throw new Exception("Size should be at least " + MinimumIPv6Bytes + " (Eth + IPv6 + TCP)");
}
byte[] bytes = new byte[size];
SharpPcap.Util.Rand.Instance.GetBytes(bytes);
TCPPacket tcp = new TCPPacket(LinkLayer.ProtocolOffset(LinkLayers.Ethernet10Mb),
bytes,
true);
MakeValid(tcp, ipver);
return(tcp);
}
/// <summary> Convert captured packet data into an object.</summary>
public static Packet dataToPacket(LinkLayers linkType, byte[] bytes, Timeval tv)
{
EthernetPacketType ethProtocol;
// retrieve the length of the headers associated with this link layer type.
// this length is the offset to the header embedded in the packet.
int byteOffsetToEthernetPayload = LinkLayer.LinkLayerLength(linkType);
// extract the protocol code for the type of header embedded in the
// link-layer of the packet
int offset = LinkLayer.ProtocolOffset(linkType);
if (offset == -1)
{
// if there is no embedded protocol, assume IpV4
ethProtocol = EthernetPacketType.IPv4;
}
else
{
ethProtocol = (EthernetPacketType)ArrayHelper.extractInteger(bytes, offset, EthernetFields_Fields.ETH_CODE_LEN);
}
string errorString;
Packet parsedPacket = null;
try
{
// try to recognize the ethernet type..
switch (ethProtocol)
{
// arp
case EthernetPacketType.ARP:
parsedPacket = new ARPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case EthernetPacketType.IPv6:
case EthernetPacketType.IPv4:
try
{
// ethernet level code is recognized as IP, figure out what kind..
int ipProtocol = IPProtocol.extractProtocol(byteOffsetToEthernetPayload, bytes);
switch (ipProtocol)
{
case (int)IPProtocol.IPProtocolType.ICMP:
parsedPacket = new ICMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.IGMP:
parsedPacket = new IGMPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.TCP:
parsedPacket = new TCPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
case (int)IPProtocol.IPProtocolType.UDP:
parsedPacket = new UDPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
// unidentified ip..
default:
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return(parsedPacket);
}
}
catch
{
// error parsing the specific ip packet type, parse as a generic IPPacket
parsedPacket = new IPPacket(byteOffsetToEthernetPayload, bytes, tv);
// check that the parsed packet is valid
if (!parsedPacket.IsValid(out errorString))
{
throw new PcapException(errorString);
}
else
{
return(parsedPacket);
}
}
// ethernet level code not recognized, default to anonymous packet..
default:
parsedPacket = new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv);
break;
}
return(parsedPacket);
}
catch
{
// we know we have at least an ethernet packet, so return that
return(new EthernetPacket(byteOffsetToEthernetPayload, bytes, tv));
}
}