public static void TimestampHelper_ConvertToByte_Test(bool reorder) { byte[] preData = { 1, 0, 0, 0, 1, 0, 0, 0 }; TimestampHelper preTimestamp = new TimestampHelper(preData, false); byte[] postData = preTimestamp.ConvertToByte(reorder); TimestampHelper postTimestamp = new TimestampHelper(postData, reorder); Assert.AreEqual(preTimestamp, postTimestamp); }
public static void TimestampHelper_Simple_Test() { byte[] testData = { 1, 0, 0, 0, 1, 0, 0, 0 }; uint TimestampHight = BitConverter.ToUInt32(testData, 0); TimestampHelper timestamp = new TimestampHelper(testData, false); Assert.AreEqual(timestamp.TimestampHight, 1); Assert.AreEqual(timestamp.TimestampLow, 1); Assert.AreEqual(timestamp.Seconds, 4294); Assert.AreEqual(timestamp.Microseconds, 967297); }
/// <summary> /// The Packet Block is marked obsolete, better use the Enhanced Packet Block instead! /// A Packet Block is the standard container for storing the packets coming from the network. The Packet Block is optional because /// packets can be stored either by means of this block or the Simple Packet Block, which can be used to speed up dump generation. /// </summary> public PacketBlock(short InterfaceID, TimestampHelper Timestamp, byte[] Data, int PacketLength, PacketOption Options, long PositionInStream = 0) { Contract.Requires<ArgumentNullException>(Timestamp != null, "Timestamp cannot be null"); Contract.Requires<ArgumentNullException>(Options != null, "Options cannot be null"); Contract.Requires<ArgumentNullException>(Data != null, "Data cannot be null"); this.InterfaceID = InterfaceID; this.Timestamp = Timestamp; this.PacketLength = PacketLength; this.Data = Data; this.options = Options; this.PositionInStream = PositionInStream; }
public static PacketBlock Parse(BaseBlock baseBlock, Action<Exception> ActionOnException) { Contract.Requires<ArgumentNullException>(baseBlock != null, "BaseBlock cannot be null"); Contract.Requires<ArgumentNullException>(baseBlock.Body != null, "BaseBlock.Body cannot be null"); Contract.Requires<ArgumentException>(baseBlock.BlockType == BaseBlock.Types.Packet, "Invalid packet type"); long positionInStream = baseBlock.PositionInStream; using (Stream stream = new MemoryStream(baseBlock.Body)) { using (BinaryReader binaryReader = new BinaryReader(stream)) { short interfaceID = binaryReader.ReadInt16().ReverseByteOrder(baseBlock.ReverseByteOrder); short dropCount = binaryReader.ReadInt16().ReverseByteOrder(baseBlock.ReverseByteOrder); byte[] timestamp = binaryReader.ReadBytes(8); if (timestamp.Length < 8) throw new EndOfStreamException("Unable to read beyond the end of the stream"); TimestampHelper timestampHelper = new TimestampHelper(timestamp, baseBlock.ReverseByteOrder); int capturedLength = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder); int packetLength = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder); byte[] data = binaryReader.ReadBytes(capturedLength); if (data.Length < capturedLength) throw new EndOfStreamException("Unable to read beyond the end of the stream"); int remainderLength = capturedLength % BaseBlock.AlignmentBoundary; if (remainderLength > 0) { int paddingLength = BaseBlock.AlignmentBoundary - remainderLength; binaryReader.ReadBytes(paddingLength); } PacketOption options = PacketOption.Parse(binaryReader, baseBlock.ReverseByteOrder, ActionOnException); PacketBlock packetBlock = new PacketBlock(interfaceID, timestampHelper, data, packetLength, options, positionInStream); return packetBlock; } } }
public InterfaceStatisticsOption(string Comment = null, TimestampHelper StartTime = null, TimestampHelper EndTime = null, long? InterfaceReceived = null, long? InterfaceDrop = null, long? FilterAccept = null, long? SystemDrop = null, long? DeliveredToUser =null) { this.Comment = Comment; this.StartTime = StartTime; this.EndTime = EndTime; this.InterfaceReceived = InterfaceReceived; this.InterfaceDrop = InterfaceDrop; this.FilterAccept = FilterAccept; this.SystemDrop = SystemDrop; this.DeliveredToUser = DeliveredToUser; }
/// <summary> /// The Interface Statistics Block contains the capture statistics for a given interface and it is optional. The statistics are referred /// to the interface defined in the current Section identified by the Interface ID field. An Interface Statistics Block is normally /// placed at the end of the file, but no assumptions can be taken about its position - it can even appear multiple times for the same /// interface. /// </summary> public InterfaceStatisticsBlock(int InterfaceID, TimestampHelper Timestamp, InterfaceStatisticsOption Options, long PositionInStream = 0) { Contract.Requires<ArgumentNullException>(Timestamp != null, "Timestamp cannot be null"); Contract.Requires<ArgumentNullException>(Options != null, "Options cannot be null"); this.InterfaceID = InterfaceID; this.Timestamp = Timestamp; this.options = Options; this.PositionInStream = PositionInStream; }
public static InterfaceStatisticsBlock Parse(BaseBlock baseBlock, Action<Exception> ActionOnException) { Contract.Requires<ArgumentNullException>(baseBlock != null, "BaseBlock cannot be null"); Contract.Requires<ArgumentNullException>(baseBlock.Body != null, "BaseBlock.Body cannot be null"); Contract.Requires<ArgumentException>(baseBlock.BlockType == BaseBlock.Types.InterfaceStatistics, "Invalid packet type"); long positionInStream = baseBlock.PositionInStream; using (Stream stream = new MemoryStream(baseBlock.Body)) { using (BinaryReader binaryReader = new BinaryReader(stream)) { int interfaceID = binaryReader.ReadInt32().ReverseByteOrder(baseBlock.ReverseByteOrder); byte[] timestamp = binaryReader.ReadBytes(8); if (timestamp.Length < 8) throw new EndOfStreamException("Unable to read beyond the end of the stream"); TimestampHelper timestampHelper = new TimestampHelper(timestamp, baseBlock.ReverseByteOrder); InterfaceStatisticsOption options = InterfaceStatisticsOption.Parse(binaryReader, baseBlock.ReverseByteOrder, ActionOnException); InterfaceStatisticsBlock statisticBlock = new InterfaceStatisticsBlock(interfaceID, timestampHelper, options, positionInStream); return statisticBlock; } } }
public static EnchantedPacketBlock CreateEnchantedPacketFromIPacket(IPacket packet, Action<Exception> ActionOnException) { Contract.Requires<ArgumentNullException>(packet != null, "packet cannot be null"); Contract.Requires<ArgumentNullException>(packet.Data != null, "packet.Data cannot be null"); TimestampHelper timestampHelper = new TimestampHelper(packet.Seconds, packet.Microseconds); EnchantedPacketBlock enchantedBlock = new EnchantedPacketBlock(0, timestampHelper, packet.Data.Length, packet.Data, new EnchantedPacketOption(), 0); return enchantedBlock; }