コード例 #1
0
ファイル: RawSocket.cs プロジェクト: well-st/sniffercsharp
        /// <summary>
        /// 解析接收的数据包,形成PacketArrivedEventArgs事件数据类对象,并引发PacketArrival事件
        /// </summary>
        /// <param name="buf"></param>
        /// <param name="len"></param>
        private void Receive(byte[] buf, int len)
        {
            var e = PacketArrivedEventArgs.ParseFrom(buf, len);//新网络数据包信息事件

            switch (e.Protocol.ToUpper())
            {
            case "TCP":
                var te = TcpPacketArrivedEventArgs.ParseTcpFrom(buf, len);
                OnPacketArrival(te);
                return;

            case "UDP":
                var ue = UdpPacketArrivedEventArgs.ParseUdpFrom(buf, len);
                OnPacketArrival(ue);
                return;
            }

            //引发PacketArrival事件
            OnPacketArrival(e);
        }
コード例 #2
0
        /// <summary>
        /// 解析TCP包
        /// </summary>
        /// <param name="buf"></param>
        /// <param name="len"></param>
        /// <returns></returns>
        public unsafe static TcpPacketArrivedEventArgs ParseTcpFrom(byte[] buf, int len)
        {
            var e = new TcpPacketArrivedEventArgs();//新网络数据包信息事件

            fixed(byte *fixedBuf = buf)
            {
                var head = (TcpHeader *)fixedBuf;//把数据流整和为IPHeader结构

                e.HeaderLength    = (uint)(head->IpHeader.IpVerLen & 0x0F) << 2;
                e.TcpHeaderLength = (uint)(head->HeaderLength & 0xF0) >> 2;
                var tempProtocol = head->IpHeader.IpProtocol;

                switch (tempProtocol) //提取协议类型
                {
                case 1:
                    e.Protocol = "ICMP";
                    break;

                case 2:
                    e.Protocol = "IGMP";
                    break;

                case 6:
                    e.Protocol = "TCP";
                    break;

                case 17:
                    e.Protocol = "UDP";
                    break;

                default:
                    e.Protocol = "UNKNOWN";
                    break;
                }

                var tempVersion = (uint)(head->IpHeader.IpVerLen & 0xF0) >> 4;

                e.IpVersion = tempVersion.ToString(CultureInfo.InvariantCulture);

                //以下语句提取出了PacketArrivedEventArgs对象中的其他参数
                var tempIpSrcaddr  = head->IpHeader.IpSrcAddr;
                var tempIpDestaddr = head->IpHeader.IpDestAddr;
                var tempIp         = new IPAddress(tempIpSrcaddr);

                e.OriginationAddress = tempIp.ToString();
                tempIp = new IPAddress(tempIpDestaddr);
                e.DestinationAddress = tempIp.ToString();

                var tempSrcport = *(short *)&fixedBuf[e.HeaderLength];
                var tempDstport = *(short *)&fixedBuf[e.HeaderLength + 2];

                e.OriginationPort = IPAddress.NetworkToHostOrder(tempSrcport).ToString(CultureInfo.InvariantCulture);
                e.DestinationPort = IPAddress.NetworkToHostOrder(tempDstport).ToString(CultureInfo.InvariantCulture);
                e.SerialNumber    = IPAddress.NetworkToHostOrder(head->SerialNumber).ToString(CultureInfo.InvariantCulture);
                e.ConfirmNumber   =
                    IPAddress.NetworkToHostOrder(head->ConfirmNumber).ToString(CultureInfo.InvariantCulture);
                e.UrgFlag    = (head->TcpFlags & 0x20) >> 5 > 0;
                e.AckFlag    = (head->TcpFlags & 0x10) >> 4 > 0;
                e.PshFlag    = (head->TcpFlags & 0x08) >> 3 > 0;
                e.PstFlag    = (head->TcpFlags & 0x04) >> 2 > 0;
                e.SynFlag    = (head->TcpFlags & 0x02) >> 1 > 0;
                e.FinFlag    = (head->TcpFlags & 0x01) > 0;
                e.WindowSize = IPAddress.NetworkToHostOrder(head->WindowSize).ToString(CultureInfo.InvariantCulture);

                e.PacketLength     = (uint)len;
                e.MessageLength    = (uint)len - e.HeaderLength;
                e.TcpMessageLength = (uint)len - e.HeaderLength - e.TcpHeaderLength;
                e.ReceiveBuffer    = buf;
                //把buf中的IP头赋给PacketArrivedEventArgs中的IPHeaderBuffer
                Array.Copy(buf, 0, e.IpHeaderBuffer, 0, (int)e.HeaderLength);
                //把buf中的包中内容赋给PacketArrivedEventArgs中的MessageBuffer
                Array.Copy(buf, (int)e.HeaderLength, e.MessageBuffer, 0, (int)e.MessageLength);
                //TCP Header;
                Array.Copy(buf, (int)(e.HeaderLength), e.TcpHeaderBuffer, 0, (int)e.TcpHeaderLength);
                //TCP Message;
                Array.Copy(buf, (int)(e.HeaderLength + e.TcpHeaderLength), e.TcpMessageBuffer, 0,
                           (int)e.TcpMessageLength);
            }

            return(e);
        }