/// <summary>
/// Constructor
/// </summary>
/// <param name="stack">Stack</param>
/// <param name="emisor">Emisor</param>
/// <param name="source">Ip Source</param>
/// <param name="dest">Ip Dest</param>
/// <param name="hwSource">Hw Source</param>
/// <param name="hwDest">Hw Dest</param>
/// <param name="tcp">Packet</param>
/// <param name="date">Date</param>
public TcpStream(TcpStreamStack stack, ETcpEmisor emisor, PhysicalAddress hwSource, PhysicalAddress hwDest, IPEndPoint source, IPEndPoint dest, TcpPacket tcp, DateTime date)
{
_TcpStack = stack;
_IsFirst = true;
_StartDate = date;
_SourceHwAddress = hwSource;
_DestinationHwAddress = hwDest;
_Key = TcpStreamStack.GetKey(source, dest, emisor == ETcpEmisor.Server);
_LastPacket = tcp;
if (tcp != null)
{
if (emisor == ETcpEmisor.Server)
{
_Destination = source;
_Source = dest;
}
else
{
_Source = source;
_Destination = dest;
}
Add(date, emisor, tcp);
}
else
{
Close();
}
}
/// <summary>
/// Load TCP Stream from WireShark TCPStreamFormat
/// </summary>
/// <param name="file">File</param>
public static TcpStream FromFile(string file)
{
TcpStream tcp = null;
if (!string.IsNullOrEmpty(file))
{
string[] sp = File.ReadAllLines(file);
IPEndPoint empty = new IPEndPoint(IPAddress.None, IPEndPoint.MinPort);
foreach (string line in sp)
{
string l = line.TrimStart().Replace(":", "");
ETcpEmisor em = line.StartsWith("\t") ? ETcpEmisor.Server : ETcpEmisor.Client;
if (tcp == null)
{
tcp = new TcpStream(null, em, PhysicalAddress.None, PhysicalAddress.None, empty, empty, null, DateTime.Now);
}
if (l.Length >= 9 && !l.Substring(0, 8).Contains(" "))
{
// remove offset
l = l.Substring(8, l.Length - 8).Trim();
}
if (l.Length > 48)
{
l = l.Substring(0, 48);
}
l = l.Replace(" ", "");
byte[] data = HexHelper.FromHexString(l);
if (tcp._Last == null)
{
tcp._Last = new TcpStreamMessage(DateTime.Now, data, em, null);
tcp._InternalList.Add(tcp._Last);
}
else
{
// Check if its the same
if (tcp._Last.Emisor == em)
{
tcp._Last.AddData(data, 0, data.Length);
}
else
{
// New Packet
tcp._Last = new TcpStreamMessage(DateTime.Now, data, em, tcp._Last);
tcp._InternalList.Add(tcp._Last);
}
}
}
}
return(tcp);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="date">Date</param>
/// <param name="data">Data</param>
/// <param name="emisor">Emisor</param>
/// <param name="previous">Previous</param>
public TcpStreamMessage(DateTime date, byte[] data, ETcpEmisor emisor, TcpStreamMessage previous)
{
_Date = date;
_Data = data;
_Emisor = emisor;
if (previous != null)
{
_Previous = previous;
previous._Next = this;
}
}
/// <summary>
/// Load TCP Stream from WireShark TCPStreamFormat
/// </summary>
/// <param name="file">File</param>
public static TcpStream FromFile(string file)
{
TcpStream tcp = new TcpStream(null);
if (!string.IsNullOrEmpty(file))
{
string[] sp = File.ReadAllLines(file);
foreach (string line in sp)
{
string l = line.TrimStart().Replace(":", "");
ETcpEmisor em = line.StartsWith(" ") ? ETcpEmisor.A : ETcpEmisor.B;
if (l.Length >= 9 && !l.Substring(0, 8).Contains(" "))
{
// remove offset
l = l.Substring(8, l.Length - 8).Trim();
}
if (l.Length > 48)
{
l = l.Substring(0, 48);
}
l = l.Replace(" ", "");
byte[] data = HexHelper.FromHexString(l);
if (tcp._Last == null)
{
tcp._Last = new TcpStreamMessage(data, em);
tcp._InternalList.Add(tcp._Last);
}
else
{
// Check if its the same
if (tcp._Last.Emisor == em)
{
tcp._Last.AddData(data);
}
else
{
// New Packet
tcp._Last = new TcpStreamMessage(data, em);
tcp._InternalList.Add(tcp._Last);
}
}
}
}
return(tcp);
}
void AppendPacket(DateTime date, TcpPacketStack stack, ETcpEmisor emisor, TcpPacket tcp)
{
if (tcp.Fin || tcp.Rst)
{
Close();
}
_LastPacket = tcp;
byte[] payload = tcp.PayloadData;
if (payload == null)
{
return;
}
int l = payload.Length;
if (l <= 0)
{
return;
}
stack.SequenceNumber += (uint)l;
if (_Last == null)
{
_Last = new TcpStreamMessage(date, payload, emisor, null);
_InternalList.Add(_Last);
}
else
{
// Check if its the same
if (_Last.Emisor == emisor)
{
_Last.AddData(payload, 0, l);
}
else
{
// New Packet
_Last = new TcpStreamMessage(date, payload, emisor, _Last);
_InternalList.Add(_Last);
}
}
if (emisor == ETcpEmisor.Client)
{
_ClientLength += l;
}
else
{
_ServerLength += l;
}
}
public void Add(DateTime date, ETcpEmisor emisor, TcpPacket tcp)
{
uint sequenceNumber = tcp.SequenceNumber;
TcpPacketStack stack = null;
switch (emisor)
{
case ETcpEmisor.Client:
{
if (_ClientStack == null)
{
_ClientStack = new TcpPacketStack((uint)(sequenceNumber + tcp.PayloadData.Length + (tcp.Syn ? 1 : 0)));
AppendPacket(date, _ClientStack, emisor, tcp);
return;
}
stack = _ClientStack;
break;
}
case ETcpEmisor.Server:
{
if (_ServerStack == null)
{
_ServerStack = new TcpPacketStack((uint)(sequenceNumber + tcp.PayloadData.Length + (tcp.Syn && tcp.Ack ? 1 : 0)));
AppendPacket(date, _ServerStack, emisor, tcp);
return;
}
stack = _ServerStack;
break;
}
}
if (stack.SequenceNumber == sequenceNumber)
{
AppendPacket(date, stack, emisor, tcp);
}
else
{
stack.Append(sequenceNumber, tcp);
}
// Try process
while (stack.TryGetNextPacket(out tcp))
{
AppendPacket(date, stack, emisor, tcp);
}
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="date">Date</param>
/// <param name="data">Data</param>
/// <param name="emisor">Emisor</param>
/// <param name="previous">Previous</param>
public TcpStreamMessage(DateTime date, byte[] data, ETcpEmisor emisor, TcpStreamMessage previous)
{
_Date = date;
_Emisor = emisor;
_Data = data;
//_Stream = new MemoryStream();
//_Stream.Write(data, 0, data.Length);
_DataLength = data.Length;
_DataCapacity = _DataLength;
if (previous != null)
{
_Previous = previous;
previous._Next = this;
}
}
void Add(TcpHeader packet)
{
if (packet.Flags.HasFlag(ETcpFlags.Fin))
{
_IsClossed = true;
}
if (packet.Data.Length <= 0)
{
return;
}
ETcpEmisor emisor =
(packet.DestinationPort == _DestinationPort && IPAddress.Equals(packet.IpHeader.DestinationAddress, _DestinationAddress) &&
packet.SourcePort == _SourcePort && IPAddress.Equals(packet.IpHeader.SourceAddress, _SourceAddress)) ? ETcpEmisor.A : ETcpEmisor.B;
if (_Last == null)
{
_Last = new TcpStreamMessage(packet.Data, emisor);
_InternalList.Add(_Last);
}
else
{
// Check if its the same
if (_Last.Emisor == emisor)
{
_Last.AddData(packet.Data);
}
else
{
// New Packet
_Last = new TcpStreamMessage(packet.Data, emisor);
_InternalList.Add(_Last);
}
}
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="data">Data</param>
/// <param name="emisor">Emisor</param>
public TcpStreamMessage(byte[] data, ETcpEmisor emisor)
{
_Data = data;
_Emisor = emisor;
}
public bool TryGetValue(IPEndPoint source, IPEndPoint dest, out TcpStream ret, out ETcpEmisor em)
{
em = dest.Port < 49152 ? ETcpEmisor.Client : ETcpEmisor.Server;
if (!_TcpStreams.TryGetValue(GetKey(source, dest, em == ETcpEmisor.Server), out ret))
{
em = em == ETcpEmisor.Client ? ETcpEmisor.Server : ETcpEmisor.Client;
if (!_TcpStreams.TryGetValue(GetKey(source, dest, em == ETcpEmisor.Server), out ret))
{
em = ETcpEmisor.Client;
return(false);
}
}
return(true);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="data">Data</param>
/// <param name="emisor">Emisor</param>
public TcpStreamMessage(byte[] data, ETcpEmisor emisor)
{
_Data = data;
_Emisor = emisor;
}
