private void device_PcapOnPacketArrival(object sender, Packet packet)
{
if (!(packet is TCPPacket))
{
return;
}
TCPPacket tcpPacket = (TCPPacket)packet;
// Creates a key for the dictionary
TCPConnection connection = new TCPConnection(tcpPacket);
// create a new entry if the key does not exists and its a new Connection
if (!sharpPcapDict.ContainsKey(connection) &&
tcpPacket.Syn && (tcpPacket.DestinationPort == this.dst_port))
{
TcpRecon tcpRecon = new TcpRecon(this.ServerStr, this.ClientStr);
sharpPcapDict.Add(connection, tcpRecon);
this.connection = tcpRecon;
// (((ip.src == 192.168.100.150) && (tcp.dstport == 7777) ) || ((ip.src == 78.46.33.43) && (tcp.dstport == 52784)))
string filter = string.Format("(((ip.src == {0}) && (tcp.dstport == {1})) || ((ip.src == {2}) && (tcp.dstport == {3})))"
, tcpPacket.SourceAddress, tcpPacket.DestinationPort, tcpPacket.DestinationAddress, tcpPacket.SourcePort);
this.tcpDumpFilter = filter;
// Geht oder geht nicht??? das is die große Frage ;)
this.device.PcapSetFilter(filter);
}
// Use the TcpRecon class to reconstruct the session
if (this.sharpPcapDict.ContainsKey(connection))
{
sharpPcapDict[connection].ReassemblePacket(tcpPacket);
}
}
private void device_PcapOnPacketArrival(object sender, Packet packet)
{
if (!(packet is TCPPacket)) return;
TCPPacket tcpPacket = (TCPPacket)packet;
// Creates a key for the dictionary
TCPConnection connection = new TCPConnection(tcpPacket);
// create a new entry if the key does not exists and its a new Connection
if (!sharpPcapDict.ContainsKey(connection)
&& tcpPacket.Syn && (tcpPacket.DestinationPort == this.dst_port))
{
TcpRecon tcpRecon = new TcpRecon(this.ServerStr, this.ClientStr);
sharpPcapDict.Add(connection, tcpRecon);
this.connection = tcpRecon;
// (((ip.src == 192.168.100.150) && (tcp.dstport == 7777) ) || ((ip.src == 78.46.33.43) && (tcp.dstport == 52784)))
string filter = string.Format("(((ip.src == {0}) && (tcp.dstport == {1})) || ((ip.src == {2}) && (tcp.dstport == {3})))"
, tcpPacket.SourceAddress, tcpPacket.DestinationPort, tcpPacket.DestinationAddress, tcpPacket.SourcePort);
this.tcpDumpFilter = filter;
// Geht oder geht nicht??? das is die große Frage ;)
this.device.PcapSetFilter(filter);
}
// Use the TcpRecon class to reconstruct the session
if (this.sharpPcapDict.ContainsKey(connection))
{
sharpPcapDict[connection].ReassemblePacket(tcpPacket);
}
}
