/// <summary> /// Checks the first four bytes for the total Trace Length /// Stores the length in _POLLDATA object and Enqueues all bytes /// </summary> /// <param name="blok">the bytes that contain the Trace Length, plus possible overflow</param> /// <returns>-1 if less than four bytes have been received, otherwise the length of the trace data</returns> private long StoreTraceLength(byte[] newBlok) { byte[] blok; if (_POLLDATA.DataQ.Count == 1) //get the previous blok, should never be greater than 1 { //Combine into 1 blok byte[] prevBlok = (byte[])_POLLDATA.DataQ.Dequeue(); int len = prevBlok.Length + newBlok.Length; blok = new byte[len]; int i = 0; for (i = 0; i < prevBlok.Length; i++) { blok[i] = prevBlok[i]; } for (i = prevBlok.Length; i < len; i++) { blok[i] = newBlok[i]; } } else { blok = newBlok; } long traceLen = -1; if (blok.Length >= 4) { traceLen = (long)SVSEUtility.GetUINT32(0, blok); } _POLLDATA.DataQ.Enqueue(blok); return(traceLen); }
/// <summary> /// Read each packet /// </summary> /// <param name="data">All of the IP packets, /// this data contains a 12 byte header before each packet /// with a 4 byte length and a 8 byte store clock</param> /// <param name="offset">offset into the data of this packet</param> /// <returns>offset of next packet</returns> private int ReadNextPacket(int offset, byte[] data, out PcapIpPacket packet, bool writeDebug) { //RawDataConverter convert = new RawDataConverter(); uint len = SVSEUtility.GetUINT32(offset, data); DateTime stck = SVSEUtility.GetDateTimeUTC(offset + 4, data);//8 byte STCK int offPack = offset + 12; //int verFromIpHeader = Convert.ToInt32(data[offPack]); ushort lenFromIpHeader = SVSEUtility.GetUINT16(offPack + 2, data);//2 bytes into the packet header packet = new PcapIpPacket(); if (writeDebug) { Debug.WriteLine( //"[ " + verFromIpHeader.ToString() + " ]" "packet offset = " + offPack.ToString("X").PadRight(8, '0') + //should be 69 for a IPv4 header " : STCK(ss:us) = " + SVSEUtility.GetUINT64(offset + 4, data).ToString("X") + " = " + SVSEUtility.GetDateTimeUTC(offset + 4, data).ToString("MM-dd-yyyy HH:mm:ss:ffffff") + " : Length = " + len.ToString().PadRight(5, ' ') + "...from IP header = " + lenFromIpHeader.ToString()); } //if (verFromIpHeader == 69)//0x45 = IPv4 with a 40 byte IP header //{ DateTime utcJan11970 = new DateTime(1970, 1, 1, 0, 0, 0).ToUniversalTime(); //UTC time on Jan 1, 1970 00:00:00 TimeSpan tspan = stck.Subtract(utcJan11970); //The timespan between Jan 1, 1970 00:00:00 and the capture uint tsSeconds = 0; //The number of seconds in the timespan uint tsUseconds = 0; //The usec offset if (tspan.TotalSeconds > 0) { /* tsSeconds must be rounded down with Math.Floor */ tsSeconds = Convert.ToUInt32(Math.Floor(tspan.TotalSeconds)); //Total seconds since Jan 1, 1970 00:00:00 tsUseconds = Convert.ToUInt32(tspan.Milliseconds * 1000); //Usec offset } uint inclLength = len; //# of bytes actually saved in file uint origLength = lenFromIpHeader; //# of bytes in packet when it was captured, in case snaplen trims it /* Get the header and data */ byte[] ipPack = new byte[inclLength]; for (int i = 0; i < ipPack.Length; i++) { ipPack[i] = data[offPack + i]; } packet = new PcapIpPacket(tsSeconds, tsUseconds, inclLength, origLength, ipPack); //}else if(writeDebug){Debug.Write("*ERROR not IPv4*");} return(offPack + Convert.ToInt32(len)); }