internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload, FlagsRadioTapField flagsField) { var payloadPacketOrData = new PacketOrByteArraySegment(); MacFrame frame = null; if (flagsField != null) { bool fcsPresent = ((flagsField.Flags & RadioTapFlags.FcsIncludedInFrame) == RadioTapFlags.FcsIncludedInFrame); if (fcsPresent) { frame = MacFrame.ParsePacketWithFcs(payload); } else { frame = MacFrame.ParsePacket(payload); } } else { frame = MacFrame.ParsePacket(payload); } if (frame == null) { payloadPacketOrData.TheByteArraySegment = payload; } else { payloadPacketOrData.ThePacket = frame; } return(payloadPacketOrData); }
/// <summary> /// Parses the <see cref="PacketDotNet.Utils.ByteArraySegment"/> into a MacFrame. /// </summary> /// <returns> /// The parsed MacFrame or null if it could not be parsed. /// </returns> /// <param name='bas'> /// The bytes of the packet. bas.Offset should point to the first byte in the mac frame. /// </param> /// <remarks>If the provided bytes dont contain the FCS then call <see cref="MacFrame.ParsePacket"/> instead. The presence of the /// FCS is usually determined by configuration of the device used to capture the packets.</remarks> public static MacFrame ParsePacketWithFcs(ByteArraySegment bas) { if (bas.Length < (MacFields.FrameControlLength + MacFields.FrameCheckSequenceLength)) { //There isn't enough data for there to be an FCS and a packet return(null); } //remove the FCS from the buffer that we will pass to the packet parsers ByteArraySegment basWithoutFcs = new ByteArraySegment(bas.Bytes, bas.Offset, bas.Length - MacFields.FrameCheckSequenceLength, bas.BytesLength - MacFields.FrameCheckSequenceLength); UInt32 fcs = EndianBitConverter.Big.ToUInt32(bas.Bytes, (bas.Offset + bas.Length) - MacFields.FrameCheckSequenceLength); MacFrame frame = ParsePacket(basWithoutFcs); if (frame != null) { frame.AppendFcs = true; frame.FrameCheckSequence = fcs; } return(frame); }
/// <summary> /// Used by the Ieee80211PpiPacket constructor. /// </summary> /// <param name="header"> /// A <see cref="ByteArraySegment"/> /// </param> /// <param name="commonField"> /// The <see cref="PpiCommon"/> object in the PPI packet or null if not available /// </param> /// <returns> /// A <see cref="PacketOrByteArraySegment"/> /// </returns> internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment header, PpiCommon commonField) { // slice off the payload var payload = header.EncapsulatedBytes(); var payloadPacketOrData = new PacketOrByteArraySegment(); MacFrame frame = null; if (commonField != null) { bool fcsPresent = ((commonField.Flags & PpiCommon.CommonFlags.FcsIncludedInFrame) == PpiCommon.CommonFlags.FcsIncludedInFrame); if (fcsPresent) { frame = MacFrame.ParsePacketWithFcs(payload); } else { frame = MacFrame.ParsePacket(payload); } } else { frame = MacFrame.ParsePacket(payload); } if (frame == null) { payloadPacketOrData.TheByteArraySegment = payload; } else { payloadPacketOrData.ThePacket = frame; } return(payloadPacketOrData); }
/// <summary> /// Parses the <see cref="PacketDotNet.Utils.ByteArraySegment"/> into a MacFrame. /// </summary> /// <returns> /// The parsed MacFrame or null if it could not be parsed. /// </returns> /// <param name='bas'> /// The bytes of the packet. bas.Offset should point to the first byte in the mac frame. /// </param> /// <remarks>If the provided bytes contain the FCS then call <see cref="MacFrame.ParsePacketWithFcs"/> instead. The presence of the /// FCS is usually determined by configuration of the device used to capture the packets.</remarks> public static MacFrame ParsePacket(ByteArraySegment bas) { if (bas.Length < MacFields.FrameControlLength) { //there isn't enough data to even try and work out what type of packet it is return(null); } //this is a bit ugly as we will end up parsing the framecontrol field twice, once here and once //inside the packet constructor. Could create the framecontrol and pass it to the packet but I think that is equally ugly FrameControlField frameControl = new FrameControlField( EndianBitConverter.Big.ToUInt16(bas.Bytes, bas.Offset)); MacFrame macFrame = null; log.DebugFormat("SubType {0}", frameControl.SubType); switch (frameControl.SubType) { case FrameControlField.FrameSubTypes.ManagementAssociationRequest: { macFrame = new AssociationRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAssociationResponse: { macFrame = new AssociationResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReassociationRequest: { macFrame = new ReassociationRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReassociationResponse: { macFrame = new AssociationResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementProbeRequest: { macFrame = new ProbeRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementProbeResponse: { macFrame = new ProbeResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReserved0: break; //TODO case FrameControlField.FrameSubTypes.ManagementReserved1: break; //TODO case FrameControlField.FrameSubTypes.ManagementBeacon: { macFrame = new BeaconFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementATIM: break; //TODO case FrameControlField.FrameSubTypes.ManagementDisassociation: { macFrame = new DisassociationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAuthentication: { macFrame = new AuthenticationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementDeauthentication: { macFrame = new DeauthenticationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAction: { macFrame = new ActionFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReserved3: break; //TODO case FrameControlField.FrameSubTypes.ControlBlockAcknowledgmentRequest: { macFrame = new BlockAcknowledgmentRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlBlockAcknowledgment: { macFrame = new BlockAcknowledgmentFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlPSPoll: break; //TODO case FrameControlField.FrameSubTypes.ControlRTS: { macFrame = new RtsFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCTS: { macFrame = new CtsFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlACK: { macFrame = new AckFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCFEnd: { macFrame = new ContentionFreeEndFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCFEndCFACK: break; //TODO case FrameControlField.FrameSubTypes.Data: case FrameControlField.FrameSubTypes.DataCFACK: case FrameControlField.FrameSubTypes.DataCFPoll: case FrameControlField.FrameSubTypes.DataCFAckCFPoll: { macFrame = new DataDataFrame(bas); break; } case FrameControlField.FrameSubTypes.DataNullFunctionNoData: case FrameControlField.FrameSubTypes.DataCFAckNoData: case FrameControlField.FrameSubTypes.DataCFPollNoData: case FrameControlField.FrameSubTypes.DataCFAckCFPollNoData: { macFrame = new NullDataFrame(bas); break; } case FrameControlField.FrameSubTypes.QosData: case FrameControlField.FrameSubTypes.QosDataAndCFAck: case FrameControlField.FrameSubTypes.QosDataAndCFPoll: case FrameControlField.FrameSubTypes.QosDataAndCFAckAndCFPoll: { macFrame = new QosDataFrame(bas); break; } case FrameControlField.FrameSubTypes.QosNullData: case FrameControlField.FrameSubTypes.QosCFAck: case FrameControlField.FrameSubTypes.QosCFPoll: case FrameControlField.FrameSubTypes.QosCFAckAndCFPoll: { macFrame = new QosNullDataFrame(bas); break; } default: //this is an unsupported (and unknown) packet type break; } return(macFrame); }