protected virtual void OnPacketArrival(PacketArrivedEventArgs e)
{
if (PacketArrival != null)
{
PacketArrival(this, e);
}
}
private void myRawSocket_PacketArrival(object sender, PacketArrivedEventArgs args)
{
if (_allows.Any(allow => allow.ShouldBeAllowed(args)))
{
AppendLog(args.ToString());
if (args.Protocol.Equals("TCP") && args.MessageLength > 20)
{
AppendLog(Encoding.UTF8.GetString(args.MessageBuffer, 20, (int)args.MessageLength - 20));
}
//if (args.Protocol.Equals("UDP") && args.MessageLength > 8)
//{
// AppendLog(Encoding.UTF8.GetString(args.MessageBuffer, 8, (int)args.MessageLength - 8));
//}
return;
}
if (_filters.Any(filter => filter.ShouldBeFiltered(args)))
{
return;
}
AppendLog(args.ToString());
if (args.Protocol.Equals("TCP") && args.MessageLength > 20)
{
AppendLog(Encoding.UTF8.GetString(args.MessageBuffer, 20, (int)args.MessageLength - 20));
}
//if (args.Protocol.Equals("UDP") && args.MessageLength > 8)
//{
// AppendLog(Encoding.UTF8.GetString(args.MessageBuffer, 8, (int) args.MessageLength - 8));
//}
//AppendLog(Encoding.UTF8.GetString(args.MessageBuffer, 4, (int) args.MessageLength - 4));
}
/// <summary>
/// 解析接收的数据包，形成PacketArrivedEventArgs事件数据类对象，并引发PacketArrival事件
/// </summary>
/// <param name="buf"></param>
/// <param name="len"></param>
private void Receive(byte[] buf, int len)
{
var e = PacketArrivedEventArgs.ParseFrom(buf, len);//新网络数据包信息事件
switch (e.Protocol.ToUpper())
{
case "TCP":
var te = TcpPacketArrivedEventArgs.ParseTcpFrom(buf, len);
OnPacketArrival(te);
return;
case "UDP":
var ue = UdpPacketArrivedEventArgs.ParseUdpFrom(buf, len);
OnPacketArrival(ue);
return;
}
//引发PacketArrival事件
OnPacketArrival(e);
}
public bool ShouldBeFiltered(PacketArrivedEventArgs eventArgs)
{
if (Protocol != "*" && !eventArgs.Protocol.Equals(Protocol))
{
return(false);
}
if (!string.IsNullOrEmpty(OriginationAddress))
{
if (!eventArgs.OriginationAddress.Equals(OriginationAddress))
{
return(false);
}
}
if (OriginationPort > 0)
{
if (int.Parse(eventArgs.OriginationPort) != OriginationPort)
{
return(false);
}
}
if (!string.IsNullOrEmpty(DestinationAddress))
{
if (!eventArgs.DestinationAddress.Equals(DestinationAddress))
{
return(false);
}
}
if (DestinationPort > 0)
{
if (int.Parse(eventArgs.DestinationPort) != DestinationPort)
{
return(false);
}
}
return(true);
}
/// <summary>
/// 解析数据包，形成PacketArrivedEventArgs事件数据类对象
/// </summary>
/// <param name="buf"></param>
/// <param name="len"></param>
/// <returns></returns>
public unsafe static PacketArrivedEventArgs ParseFrom(byte[] buf, int len)
{
var e = new PacketArrivedEventArgs();//新网络数据包信息事件
fixed(byte *fixedBuf = buf)
{
var head = (IpHeader *)fixedBuf;//把数据流整和为IPHeader结构
e.HeaderLength = (uint)(head->IpVerLen & 0x0F) << 2;
var tempProtocol = head->IpProtocol;
switch (tempProtocol) //提取协议类型
{
case 1:
e.Protocol = "ICMP";
break;
case 2:
e.Protocol = "IGMP";
break;
case 6:
e.Protocol = "TCP";
break;
case 17:
e.Protocol = "UDP";
break;
default:
e.Protocol = "UNKNOWN";
break;
}
var tempVersion = (uint)(head->IpVerLen & 0xF0) >> 4;
e.IpVersion = tempVersion.ToString(CultureInfo.InvariantCulture);
//以下语句提取出了PacketArrivedEventArgs对象中的其他参数
var tempIpSrcaddr = head->IpSrcAddr;
var tempIpDestaddr = head->IpDestAddr;
var tempIp = new IPAddress(tempIpSrcaddr);
e.OriginationAddress = tempIp.ToString();
tempIp = new IPAddress(tempIpDestaddr);
e.DestinationAddress = tempIp.ToString();
var tempSrcport = *(short *)&fixedBuf[e.HeaderLength];
var tempDstport = *(short *)&fixedBuf[e.HeaderLength + 2];
e.OriginationPort = IPAddress.NetworkToHostOrder(tempSrcport).ToString(CultureInfo.InvariantCulture);
e.DestinationPort = IPAddress.NetworkToHostOrder(tempDstport).ToString(CultureInfo.InvariantCulture);
e.PacketLength = (uint)len;
e.MessageLength = (uint)len - e.HeaderLength;
e.ReceiveBuffer = buf;
//把buf中的IP头赋给PacketArrivedEventArgs中的IPHeaderBuffer
Array.Copy(buf, 0, e.IpHeaderBuffer, 0, (int)e.HeaderLength);
//把buf中的包中内容赋给PacketArrivedEventArgs中的MessageBuffer
Array.Copy(buf, (int)e.HeaderLength, e.MessageBuffer, 0, (int)e.MessageLength);
}
return(e);
}
