public PcapParser(IPcapStreamReader pcapStreamReader, byte[] firstFourBytes) { this.pcapStreamReader = pcapStreamReader; this.metadata = new List <KeyValuePair <string, string> >(); //read pcap file header! byte[] buffer4 = new byte[4]; //32 bits is suitable byte[] buffer2 = new byte[2]; //16 bits is sometimes needed //uint wiresharkMagicNumber = 0xa1b2c3d4; //Section Header Block (mandatory) if (firstFourBytes == null || firstFourBytes.Length != 4) { buffer4 = this.pcapStreamReader.BlockingRead(4); } else { buffer4 = firstFourBytes; } if (this.ToUInt32(buffer4, false) == LIBPCAP_MAGIC_NUMBER) { this.littleEndian = false; this.metadata.Add(new KeyValuePair <string, string>("Endianness", "Big Endian")); } else if (this.ToUInt32(buffer4, true) == LIBPCAP_MAGIC_NUMBER) { this.littleEndian = true; this.metadata.Add(new KeyValuePair <string, string>("Endianness", "Little Endian")); } else { throw new System.IO.InvalidDataException("The stream is not a PCAP file. Magic number is " + this.ToUInt32(buffer4, false).ToString("X2") + " or " + this.ToUInt32(buffer4, true).ToString("X2") + " but should be " + LIBPCAP_MAGIC_NUMBER.ToString("X2") + "."); } /* major version number */ this.pcapStreamReader.BlockingRead(buffer2, 0, 2); ushort majorVersionNumber = ToUInt16(buffer2, this.littleEndian); /* minor version number */ this.pcapStreamReader.BlockingRead(buffer2, 0, 2); ushort minorVersionNumber = ToUInt16(buffer2, this.littleEndian); /* GMT to local correction */ this.pcapStreamReader.BlockingRead(buffer4, 0, 4); int timezoneOffsetSeconds = (int)ToUInt32(buffer4, this.littleEndian); /* accuracy of timestamps */ this.pcapStreamReader.BlockingRead(buffer4, 0, 4); /* max length of captured packets, in octets */ this.pcapStreamReader.BlockingRead(buffer4, 0, 4); uint maximumPacketSize = ToUInt32(buffer4, this.littleEndian); /* data link type */ this.pcapStreamReader.BlockingRead(buffer4, 0, 4); //offset = 20 = 0x14 this.dataLinkType = (PcapFrame.DataLinkTypeEnum)ToUInt32(buffer4, this.littleEndian); this.metadata.Add(new KeyValuePair <string, string>("Data Link Type", dataLinkType.ToString())); }
internal PpiPacket(Frame parentFrame, int packetStartIndex, int packetEndIndex) : base(parentFrame, packetStartIndex, packetEndIndex, "PPI") { this.ppiLength = Utils.ByteConverter.ToUInt16(parentFrame.Data, packetStartIndex + 2, true); if (!this.ParentFrame.QuickParse) { base.Attributes.Add("Length", "" + ppiLength); } uint dataLinkTypeUInt = Utils.ByteConverter.ToUInt32(parentFrame.Data, packetStartIndex + 4, 4, true); this.dataLinkType = (PcapFrame.DataLinkTypeEnum)dataLinkTypeUInt; if (!this.ParentFrame.QuickParse) { base.Attributes.Add("Data Link Type", dataLinkType.ToString()); } }