public void Update(IPHelper.I_SOCKET_ROW socketRow, UInt64 Interval)
{
if (socketRow != null)
{
State = (int)socketRow.State;
}
// a program may have been removed than the sockets get unasigned and has to be re asigned
if (Program == null)
{
Program prog = ProgID == null ? null : App.engine.ProgramList.FindProgram(ProgID, true, ProgramID.FuzzyModes.Any);
if (prog != null)
{
Program = prog;
prog.AddSocket(this);
Access = prog.LookupRuleAccess(this);
}
}
Stats.Update(Interval);
}
public void Update(IPHelper.I_SOCKET_ROW socketRow, UInt64 Interval)
{
State = (int)socketRow.State;
Stats.Update(Interval);
}
public void UpdateSockets()
{
UInt64 curTick = MiscFunc.GetTickCount64();
UInt64 Interval = curTick - LastUpdate;
LastUpdate = curTick;
List <IPHelper.I_SOCKET_ROW> Sockets = new List <IPHelper.I_SOCKET_ROW>();
// enum all ockets
IntPtr tcp4Table = IPHelper.GetTcpSockets(ref Sockets);
IntPtr tcp6Table = IPHelper.GetTcp6Sockets(ref Sockets);
IntPtr udp4Table = IPHelper.GetUdpSockets(ref Sockets);
IntPtr udp6Table = IPHelper.GetUdp6Sockets(ref Sockets);
MultiValueDictionary <UInt64, NetworkSocket> OldSocketList = SocketList.Clone();
for (int i = 0; i < Sockets.Count; i++)
{
IPHelper.I_SOCKET_ROW SocketRow = Sockets[i];
NetworkSocket Socket = FindSocket(OldSocketList, SocketRow.ProcessId, SocketRow.ProtocolType, SocketRow.LocalAddress, SocketRow.LocalPort, SocketRow.RemoteAddress, SocketRow.RemotePort, NetworkSocket.MatchMode.Strict);
if (Socket != null)
{
//AppLog.Debug("Found Socket {0}:{1} {2}:{3}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort);
OldSocketList.Remove(Socket.HashID, Socket);
}
else
{
Socket = new NetworkSocket(SocketRow.ProcessId, SocketRow.ProtocolType, SocketRow.LocalAddress, SocketRow.LocalPort, SocketRow.RemoteAddress, SocketRow.RemotePort);
//AppLog.Debug("Added Socket {0}:{1} {2}:{3}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort);
SocketList.Add(Socket.HashID, Socket);
}
// Note: sockets observed using ETW are not yet initialized as we are missing owner informations there
if (Socket.ProgID == null)
{
Socket.CreationTime = SocketRow.CreationTime;
if (App.engine.DnsInspector != null && Socket.RemoteAddress != null)
{
App.engine.DnsInspector.GetHostName(Socket.ProcessId, Socket.RemoteAddress, Socket, NetworkSocket.HostSetter);
}
var moduleInfo = SocketRow.Module;
if (moduleInfo == null || moduleInfo.ModulePath.Equals("System", StringComparison.OrdinalIgnoreCase))
{
Socket.ProgID = ProgramID.NewID(ProgramID.Types.System);
}
else
{
string fileName = moduleInfo.ModulePath;
string serviceTag = moduleInfo.ModuleName;
// Note: for services and system TCPIP_OWNER_MODULE_BASIC_INFO.pModuleName is the same TCPIP_OWNER_MODULE_BASIC_INFO.pModulePath
// hence we don't have the actuall exe path and we will have to resolve it.
if (serviceTag.Equals(fileName))
{
fileName = null; // filename not valid
}
else
{
serviceTag = null; // service tag not valid
}
Socket.ProgID = App.engine.GetProgIDbyPID(Socket.ProcessId, serviceTag, fileName);
}
}
Socket.Update(SocketRow, Interval);
//IPHelper.ModuleInfo Info = SocketRow.Module;
//AppLog.Debug("Socket {0}:{1} {2}:{3} {4}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort, (Info != null ? (Info.ModulePath + " (" + Info.ModuleName + ")") : "") + " [PID: " + Socket.ProcessId + "]");
}
foreach (NetworkSocket Socket in OldSocketList.GetAllValues())
{
bool bIsUDPPseudoCon = (Socket.ProtocolType & (UInt32)IPHelper.AF_PROT.UDP) == (UInt32)IPHelper.AF_PROT.UDP && Socket.RemotePort != 0;
// Note: sockets observed using ETW are not yet initialized as we are missing owner informations there
if (Socket.ProgID == null)
{
Socket.CreationTime = DateTime.Now;
if (App.engine.DnsInspector != null && Socket.RemoteAddress != null)
{
App.engine.DnsInspector.GetHostName(Socket.ProcessId, Socket.RemoteAddress, Socket, NetworkSocket.HostSetter);
}
// Note: etw captured connections does not handle services to well :/
Socket.ProgID = App.engine.GetProgIDbyPID(Socket.ProcessId, null, null);
}
Socket.Update(null, Interval);
if (bIsUDPPseudoCon && (DateTime.Now - Socket.LastActivity).TotalMilliseconds < 5000) // 5 sec // todo: customize udp pseudo con time
{
OldSocketList.Remove(Socket.HashID, Socket);
if (Socket.RemovedTimeStamp != 0)
{
Socket.RemovedTimeStamp = 0;
}
}
else
{
Socket.State = (int)IPHelper.MIB_TCP_STATE.CLOSED;
}
}
UInt64 CurTick = MiscFunc.GetCurTick();
foreach (NetworkSocket Socket in OldSocketList.GetAllValues())
{
if (Socket.RemovedTimeStamp == 0)
{
Socket.RemovedTimeStamp = CurTick;
}
else if (Socket.RemovedTimeStamp < CurTick + 3000) // todo: customize retention time
{
SocketList.Remove(Socket.HashID, Socket);
Socket.Program?.RemoveSocket(Socket);
}
//AppLog.Debug("Removed Socket {0}:{1} {2}:{3}", CurSocket.LocalAddress, CurSocket.LocalPort, CurSocket.RemoteAddress, CurSocket.RemotePort);
}
// cleanup
if (tcp4Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(tcp4Table);
}
if (tcp6Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(tcp6Table);
}
if (udp4Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(udp4Table);
}
if (udp6Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(udp6Table);
}
}
public void UpdateSockets()
{
UInt64 curTick = MiscFunc.GetTickCount64();
UInt64 Interval = curTick - LastUpdate;
LastUpdate = curTick;
List <IPHelper.I_SOCKET_ROW> Sockets = new List <IPHelper.I_SOCKET_ROW>();
// enum all ockets
IntPtr tcp4Table = IPHelper.GetTcpSockets(ref Sockets);
IntPtr tcp6Table = IPHelper.GetTcp6Sockets(ref Sockets);
IntPtr udp4Table = IPHelper.GetUdpSockets(ref Sockets);
IntPtr udp6Table = IPHelper.GetUdp6Sockets(ref Sockets);
MultiValueDictionary <UInt64, NetworkSocket> OldSocketList = SocketList.Clone();
for (int i = 0; i < Sockets.Count; i++)
{
IPHelper.I_SOCKET_ROW SocketRow = Sockets[i];
NetworkSocket Socket = FindSocket(OldSocketList, SocketRow.ProcessId, SocketRow.ProtocolType, SocketRow.LocalAddress, SocketRow.LocalPort, SocketRow.RemoteAddress, SocketRow.RemotePort, NetworkSocket.MatchMode.Strict);
if (Socket != null)
{
//AppLog.Debug("Found Socket {0}:{1} {2}:{3}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort);
OldSocketList.Remove(Socket.HashID, Socket);
}
else
{
Socket = new NetworkSocket(SocketRow.ProcessId, SocketRow.ProtocolType, SocketRow.LocalAddress, SocketRow.LocalPort, SocketRow.RemoteAddress, SocketRow.RemotePort);
//AppLog.Debug("Added Socket {0}:{1} {2}:{3}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort);
SocketList.Add(Socket.HashID, Socket);
}
// Note: sockets observed using ETW are not yet initialized as we are missing owner informations there
if (Socket.ProgID == null)
{
Socket.CreationTime = SocketRow.CreationTime;
if (Socket.RemoteAddress != null)
{
App.engine.DnsInspector.GetHostName(Socket.ProcessId, Socket.RemoteAddress, Socket, NetworkSocket.HostSetter);
}
var moduleInfo = SocketRow.Module;
if (moduleInfo == null || moduleInfo.ModulePath.Equals("System", StringComparison.OrdinalIgnoreCase))
{
Socket.ProgID = ProgramID.NewID(ProgramID.Types.System);
}
else
{
string fileName = moduleInfo.ModulePath;
string serviceTag = moduleInfo.ModuleName;
// Note: for services and system TCPIP_OWNER_MODULE_BASIC_INFO.pModuleName is the same TCPIP_OWNER_MODULE_BASIC_INFO.pModulePath
// hence we don't have the actuall exe path and we will have to resolve it.
if (serviceTag.Equals(fileName))
{
fileName = null; // filename not valid
}
else
{
serviceTag = null; // service tag not valid
}
Socket.ProgID = App.engine.GetProgIDbyPID(Socket.ProcessId, serviceTag, fileName);
}
}
// a program may have been removed than the sockets get unasigned and has to be re asigned
if (Socket.Assigned == false)
{
Program prog = Socket.ProgID == null ? null : App.engine.ProgramList.GetProgram(Socket.ProgID, true, ProgramList.FuzzyModes.Any);
prog?.AddSocket(Socket);
if (prog != null)
{
Socket.Access = prog.LookupRuleAccess(Socket);
}
}
Socket.Update(SocketRow, Interval);
//IPHelper.ModuleInfo Info = SocketRow.Module;
//AppLog.Debug("Socket {0}:{1} {2}:{3} {4}", Socket.LocalAddress, Socket.LocalPort, Socket.RemoteAddress, Socket.RemotePort, (Info != null ? (Info.ModulePath + " (" + Info.ModuleName + ")") : "") + " [PID: " + Socket.ProcessId + "]");
}
UInt64 CurTick = MiscFunc.GetCurTick();
foreach (NetworkSocket Socket in OldSocketList.GetAllValues())
{
if (Socket.RemovedTimeStamp == 0)
{
Socket.RemovedTimeStamp = CurTick;
}
else if (Socket.RemovedTimeStamp < CurTick + 3000) // todo: customize retention time
{
SocketList.Remove(Socket.HashID, Socket);
Program prog = Socket.ProgID == null ? null : App.engine.ProgramList.GetProgram(Socket.ProgID);
prog?.RemoveSocket(Socket);
}
//AppLog.Debug("Removed Socket {0}:{1} {2}:{3}", CurSocket.LocalAddress, CurSocket.LocalPort, CurSocket.RemoteAddress, CurSocket.RemotePort);
}
// cleanup
if (tcp4Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(tcp4Table);
}
if (tcp6Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(tcp6Table);
}
if (udp4Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(udp4Table);
}
if (udp6Table != IntPtr.Zero)
{
Marshal.FreeHGlobal(udp6Table);
}
}
