public void Parse() { var frameList = new List <Frame>(); using (var process = new TSharkProcess(new FrameListQuery(mParser.NetworkTrace.FullName, new[] { WSD_REQUEST_FILTER, WSD_RESPONSE_FILTER }))) { frameList.AddRange(process.StandartOutput.ReadAllLines() .Select(line => line.Split('\t')) .Select(parts => new Frame(int.Parse(parts[0]), mParser.NetworkTrace, parts[1], parts[2], String.Empty, String.Empty, "ws-discovery")) .Where(item => null != UnitSet.GetUnit(item.SourceMac))); } if (0 == frameList.Count) { return; } var frames = new List <String>(); using (var process = new TSharkProcess(new WSDiscoveryQuery(frameList.Select(item => item.Number), mParser.NetworkTrace.FullName))) { frames.AddRange(process.StandartOutput.ReadAllLines().Select(HexToASCIIConverter.Convert)); } var xmlList = BuildXmlList(ref frames); var requests = xmlList.Where(item => null != item.GetElementWithName("Probe")).ToList(); var responses = xmlList.Where(item => null != item.GetElementWithName("ProbeMatches")).Distinct(new ProbeMatchesEqualityComparer()).ToList(); var pairs = BuildPairs(frameList, xmlList, requests, responses); ProcessPairs(frameList, xmlList, pairs); }
private void ProcessPairs(List <Frame> frameList, List <XElement> xmlList, IEnumerable <Tuple <XElement, XElement> > pairs) { foreach (var pair in pairs) { var requestFrame = frameList[xmlList.IndexOf(pair.Item1)]; var responseFrame = frameList[xmlList.IndexOf(pair.Item2)]; var client = UnitSet.GetUnit(responseFrame.DestinationMac); var device = UnitSet.GetUnit(responseFrame.SourceMac); var conversation = ConversationList.Find(client, device); if (null == conversation) { continue; } var request = new DiscoveryMessage(requestFrame, conversation, MessageType.Request); PackXml(pair.Item1, conversation, requestFrame, MessageType.Request); var response = new DiscoveryMessage(responseFrame, conversation, MessageType.Response); PackXml(pair.Item2, conversation, responseFrame, MessageType.Response); conversation.Add(new RequestResponsePair(request, response, mParser.NetworkTrace, conversation, ContentType.WSDiscovery)); } }
private void ParseConversations() { String args = String.Format("{0} \"{1}\" {2} {3} {4} {3} {5} {3} {6} {3} {7} {8} \"{9}.{10}\"", TSharkHelper.ARG_READ_FILE, NetworkTrace.FullName, TSharkHelper.FILTER_FIELDS, TSharkHelper.FIELD, TSharkHelper.FIELD_REQUEST_IN, TSharkHelper.FIELD_FRAME_NUMBER, TSharkHelper.FIELD_MAC_DST, TSharkHelper.FIELD_MAC_SRC, TSharkHelper.ARG_DISPLAY_FILTER, CTTSettings.PROTOCOL_HTTP, CTTSettings.FILTER_RESPONSE); String output; if (!TSharkHelper.RunTShark(args, out output)) { return; } var detectedDevices = FrameList.GetDevices(); String[] lines = output.SplitToLines(); foreach (String[] parts in lines.Select(line => line.Split(TSharkHelper.OUTPUT_SEPARATOR))) { int requestFrameNumber; int responseFrameNumber; int.TryParse(parts[0], out requestFrameNumber); // 0 as default value if TryParse failed if (0 == requestFrameNumber) { continue; } int.TryParse(parts[1], out responseFrameNumber); String clientMac = parts[2]; String deviceMac = parts[3]; Unit client = UnitSet.GetUnit(clientMac); if (null == client) { var macIpPair = detectedDevices.First(item => item.Item1 == clientMac); client = new Client(NetworkTrace, macIpPair.Item1, macIpPair.Item2); UnitSet.Add(client); } else { client.FoundInTraces.Add(NetworkTrace); } Unit device = UnitSet.GetUnit(deviceMac); if (null == device) { var macIpPair = detectedDevices.First(item => item.Item1 == deviceMac); device = new Device(NetworkTrace, macIpPair.Item1, macIpPair.Item2); UnitSet.Add(device); } else { device.FoundInTraces.Add(NetworkTrace); } var conversation = ConversationList.Find(client, device); if (null == conversation) { conversation = new Conversation(NetworkTrace, client, device); ConversationList.Add(conversation); } conversation.FoundInTraces.Add(NetworkTrace); Directory.CreateDirectory(ConversationHelper.GetConversationFolder(NetworkTrace, conversation)); var request = new HttpRequest(FrameList.GetFrame(requestFrameNumber), conversation); var response = new HttpResponse(FrameList.GetFrame(responseFrameNumber), conversation); conversation.Add(new RequestResponsePair(request, response, NetworkTrace, conversation, ContentType.Http)); } }