public PhysicalAddress Resolve(IPAddress destIP)
{
var request = BuildRequest(destIP, LocalMAC, LocalIP);
String arpFilter = "arp and ether dst " + LocalMAC.ToString();
_device.Open(DeviceMode.Promiscuous, 20);
_device.Filter = arpFilter;
var lastRequestTime = DateTime.FromBinary(0);
var requestInterval = new TimeSpan(0, 0, 1);
PacketDotNet.ARPPacket arpPacket = null;
var timeoutDateTime = DateTime.Now + timeout;
while (DateTime.Now < timeoutDateTime)
{
if (requestInterval < (DateTime.Now - lastRequestTime))
{
_device.SendPacket(request);
lastRequestTime = DateTime.Now;
}
var reply = _device.GetNextPacket();
if (reply == null)
{
continue;
}
var packet = PacketDotNet.Packet.ParsePacket(reply.LinkLayerType, reply.Data);
arpPacket = PacketDotNet.ARPPacket.GetEncapsulated(packet);
if (arpPacket == null)
{
continue;
}
if (arpPacket.SenderProtocolAddress.Equals(destIP))
{
break;
}
}
_device.Close();
if (DateTime.Now >= timeoutDateTime)
{
return(null);
}
else
{
return(arpPacket.SenderHardwareAddress);
}
}
private static void HandleArpPacket(ARPPacket arpPacket)
{
if (Properties.Settings.Default.DiscoveryMode) {
Console.WriteLine(arpPacket);
}
if (arpPacket.SenderHardwareAddress.Equals(dashMac)) {
Console.WriteLine(DateTime.Now + " Dash ARP");
// Dash seems to send two ARP packets per button press, one second apart.
// Dash device is active (blinking) for about 10 seconds after button press,
// and doesn't allow another press for another 25 seconds.
// 36 seconds after the initial push, the device sends the same two ARP packets.
var now = DateTime.Now;
if (now - Properties.Settings.Default.DuplicateIgnoreInterval > lastEventTime) {
lastEventTime = now;
Console.WriteLine("Dash button event");
// TODO: What to do here?
}
}
}
/*
public EthernetPacketType NAT_incoming_packet(ref byte[] data, PhysicalAddress dstMAC, PhysicalAddress srcMAC)
{
EthernetPacketType ethernet_packet_type = getEthernetPacketType(ref data);
if (!isIpOrArpPacket(ethernet_packet_type))
return ethernet_packet_type;
xbs_nat_entry nat_entry;
lock (NAT_list)
{
if (!NAT_list.TryGetValue(srcMAC, out nat_entry))
{
IPAddress sourceIP = getSourceIPFromRawPacketData(ref data, ethernet_packet_type);
if (sourceIP.Equals(ip_zero))
return ethernet_packet_type;
IPAddress destinationIP = getDestinationIPFromRawPacketData(ref data, ethernet_packet_type);
nat_entry = ip_pool.requestIP( sourceIP, srcMAC );
if (nat_entry == null)
{
xbs_messages.addInfoMessage("!! % out of NAT IPs. Could not nat incoming packet");
return ethernet_packet_type;
}
NAT_list.Add(srcMAC, nat_entry);
#if DEBUG
xbs_messages.addDebugMessage("% new device in NAT list: " + srcMAC + " " + nat_entry.original_source_ip + "=>" + nat_entry.natted_source_ip);
#endif
}
else
{
#if DEBUG
xbs_messages.addDebugMessage("% found device in NAT list: " + srcMAC + " " + nat_entry.original_source_ip + "=>" + nat_entry.natted_source_ip);
#endif
}
}
replaceSourceIpWithNATSourceIP(ref data, ethernet_packet_type, ref nat_entry);
if (ethernet_packet_type == EthernetPacketType.IpV4)
{
if (dstMAC.Equals(broadcast_mac) && nat_entry.natted_broadcast!=null)
replaceBroadcastIPAddress(ref data, ref nat_entry.natted_broadcast_bytes);
updateIPChecksums(ref data);
}
return ethernet_packet_type;
}
*/
public EthernetPacketType NAT_incoming_packet_PacketDotNet(ref byte[] data, PhysicalAddress dstMAC, PhysicalAddress srcMAC, ref Packet p, ref IPv4Packet p_IPV4, ref ARPPacket p_ARP)
{
xbs_nat_entry nat_entry;
EthernetPacketType p_type = ((EthernetPacket)p).Type;
if (p_type != EthernetPacketType.IpV4 && p_type != EthernetPacketType.Arp)
return p_type;
lock (NAT_list)
{
if (!NAT_list.TryGetValue(srcMAC, out nat_entry))
{
IPAddress sourceIP = (p_IPV4!=null) ? p_IPV4.SourceAddress : p_ARP.SenderProtocolAddress;
if (sourceIP.Equals(ip_zero))
return p_type;
IPAddress destinationIP = (p_IPV4 != null) ? p_IPV4.DestinationAddress : p_ARP.TargetProtocolAddress;
nat_entry = ip_pool.requestIP(sourceIP, srcMAC);
if (nat_entry == null)
{
if (!natIPpoolOverflow_warning_shown)
{
natIPpoolOverflow_warning_shown = true;
xbs_messages.addInfoMessage("!! % out of NAT IPs. Could not NAT incoming packet", xbs_message_sender.NAT, xbs_message_type.WARNING);
}
return p_type;
}
else
{
natIPpoolOverflow_warning_shown = false;
NAT_list.Add(srcMAC, nat_entry);
#if DEBUG
xbs_messages.addDebugMessage("% new device in NAT list: " + srcMAC + " " + nat_entry.original_source_ip + "=>" + nat_entry.natted_source_ip, xbs_message_sender.NAT);
#endif
}
}
else
{
#if DEBUG
xbs_messages.addDebugMessage("% found device in NAT list: " + srcMAC + " " + nat_entry.original_source_ip + "=>" + nat_entry.natted_source_ip, xbs_message_sender.NAT);
#endif
}
}
if (p_IPV4 != null)
{
p_IPV4.SourceAddress = nat_entry.natted_source_ip;
if (dstMAC.Equals(broadcast_mac) && nat_entry.natted_broadcast != null)
p_IPV4.DestinationAddress = nat_entry.natted_broadcast;
p_IPV4.UpdateIPChecksum();
if (p_IPV4.Protocol == IPProtocolType.UDP)
{
UdpPacket p_UDP = (UdpPacket)p_IPV4.PayloadPacket;
if (NAT_enablePS3mode)
{
bool ret = PS3_replaceInfoResponse_hostAddr(dstMAC, ref p_UDP, nat_entry.natted_source_ip);
if (!ret)
ret = PS3_replaceClientAnswer_hostAddr(dstMAC, ref p_UDP, nat_entry.natted_source_ip, nat_entry.original_source_ip);
}
p_UDP.UpdateUDPChecksum();
}
else if (p_IPV4.Protocol == IPProtocolType.TCP)
((TcpPacket)p_IPV4.PayloadPacket).UpdateTCPChecksum();
}
else
{
p_ARP.SenderProtocolAddress = nat_entry.natted_source_ip;
}
data = p.BytesHighPerformance.ActualBytes();
return p_type;
}
//ARP协议的Info
private string setArpInfo(ARPPacket ARP)
{
string senderIP = ARP.SenderProtocolAddress.ToString();
string targetIP = ARP.TargetProtocolAddress.ToString();
string targetMac = ARP.TargetHardwareAddress.ToString();
if (senderIP == targetIP)
return "Gratuitous ARP for " + senderIP;
else if (ARP.Operation.ToString() == "Request")
return "Who has " + targetIP + "? Tell " + senderIP;
else if (ARP.Operation.ToString() == "Response")
return targetIP + " is at " + targetMac;
else
return "Unknown state";
}
//在树形控件中加入arp节点
private void arpTreeView(ARPPacket ARP)
{
TreeNode arpNode = new TreeNode();
arpNode.Text = "Address Resolution Protocal (" + ARP.Operation.ToString() + ")";
treeView.Nodes.Add(arpNode);
arpNode.Nodes.Add(new TreeNode("Hardware type: " + ARP.HardwareAddressType + " (" + ARP.Header[0].ToString("D") + ARP.Header[1].ToString("D") + ")"));
arpNode.Nodes.Add(new TreeNode("Protocal type: " + ARP.ProtocolAddressType + " (0x" + ARP.Header[2].ToString("X2") + ARP.Header[3].ToString("X2") + ")"));
arpNode.Nodes.Add(new TreeNode("Hardware size: " + ARP.HardwareAddressLength));
arpNode.Nodes.Add(new TreeNode("Protocal size: " + ARP.ProtocolAddressLength));
arpNode.Nodes.Add(new TreeNode("Opcode: " + ARP.Operation + " (" + ARP.Header[6].ToString("D") + ARP.Header[7].ToString("D") + ")"));
arpNode.Nodes.Add(new TreeNode("Sender Mac address: " + ARP.SenderHardwareAddress));
arpNode.Nodes.Add(new TreeNode("Sender IP address: " + ARP.SenderProtocolAddress));
arpNode.Nodes.Add(new TreeNode("Target Mac address: " + ARP.TargetHardwareAddress));
arpNode.Nodes.Add(new TreeNode("Target IP address: " + ARP.TargetProtocolAddress));
this.treeView.ExpandAll();
}
private bool is_injected_packet_to_be_filtered(ref ARPPacket p_arp, ref IPv4Packet p_ipv4, ref UdpPacket p_udp, ref TcpPacket p_tcp)
{
// FILTER ARP PACKETS
if (p_arp != null)
{
// FILTER ARP PACKETS TO OR FROM GATEWAY IPs
foreach (IPAddress ip in gateway_ips)
{
if (p_arp.TargetProtocolAddress.Equals(ip))
return true;
else if (p_arp.SenderProtocolAddress.Equals(ip))
return true;
}
}
// FILTER IPv4 PACKETS
if (p_ipv4 != null)
{
// FILTER IP PACKETS TO OR FROM GATEWAY IPs
if (pdev_filter_exclude_gatway_ips)
{
foreach (IPAddress ip in gateway_ips)
{
if (p_ipv4.DestinationAddress.Equals(ip))
return true;
else if (p_ipv4.SourceAddress.Equals(ip))
return true;
}
}
}
// FILTER UDP PACKETS
if (p_udp != null)
{
// FILTER UDP PACKETS TO WELL KNOWN PORTS
if (pdev_filter_wellknown_ports && p_udp.DestinationPort < 1024)
return true;
}
// FILTER TCP PACKETS
if (p_tcp != null)
{
// FILTER TCP PACKETS TO WELL KNOWN PORTS
if (pdev_filter_wellknown_ports && p_tcp.DestinationPort < 1024)
return true;
}
return false;
}
/// <summary>
/// 获取网关IP
/// </summary>
/// <param name="destIP"></param>
/// <returns></returns>
public PhysicalAddress Resolve(IPAddress destIP)
{
//构造ARP请求包
//var request = getSenderPacket(IPTOBYTE(LocalIP.ToString()), IPTOBYTE(destIP.ToString()),MACTOBYTE( LocalMAC.ToString()));
var request = BuildRequest(destIP, LocalMAC, LocalIP);
//创建一个只允许读取ARP回复的“TCPDUMP”过滤器
String arpFilter = "arp and ether dst " + LocalMAC.ToString();
//打开设备设置20ms的超时
_device.Open(DeviceMode.Promiscuous, 20);
//设置过滤器
_device.Filter = arpFilter;
// set a last request time that will trigger sending the
// arp request immediately
var lastRequestTime = DateTime.FromBinary(0);
var requestInterval = new TimeSpan(0, 0, 1);
PacketDotNet.ARPPacket arpPacket = null;
// 尝试用当前超时解析地址
var timeoutDateTime = DateTime.Now + timeout;
while (DateTime.Now < timeoutDateTime)
{
if (requestInterval < (DateTime.Now - lastRequestTime))
{
// inject the packet to the wire
_device.SendPacket(request);
lastRequestTime = DateTime.Now;
}
//read the next packet from the network
var reply = _device.GetNextPacket();
if (reply == null)
{
continue;
}
// parse the packet
var packet = Packet.ParsePacket(reply.LinkLayerType, reply.Data);
// is this an arp packet?
arpPacket = ARPPacket.GetEncapsulated(packet);
if (arpPacket == null)
{
continue;
}
//if this is the reply we're looking for, stop
if (arpPacket.SenderProtocolAddress.Equals(destIP))
{
break;
}
}
// free the device
_device.Close();
// the timeout happened
if (DateTime.Now >= timeoutDateTime)
{
return(null);
}
else
{
//return the resolved MAC address
return(arpPacket.SenderHardwareAddress);
}
}
//发送ARP广播，返回192.168局域网中其他计算机的ARP相应数据包
public static ArrayList ARPBroadcast(LivePcapDevice device)
{
ArrayList tmpArrayList = new ArrayList();
PhysicalAddress localMAC = device.Interface.MacAddress;
//这是我们伪造的一个IP
IPAddress srcIP = IPAddress.Parse("192.168.3.3");
String arpFilter = "arp and ether dst " + localMAC.ToString();
//open the device with 20ms timeout
device.Open(DeviceMode.Normal, 20);
device.Filter = arpFilter;
IPAddress destIP;
SharpPcap.ARP tmpArp = new ARP();
//发送65535个数据包耗时30秒，这30秒内到达的数据包由网卡缓存
for (int i = 0; i < 256; i++)
{
for (int j = 0; j < 256; j++)
{
destIP = IPAddress.Parse("192.168." + i.ToString() + "." + j.ToString());
//request是Packet类型
var request = tmpArp.BuildRequest(destIP, localMAC, srcIP);
//发送数据包到网络中
device.SendPacket(request);
}
}
DateTime StartTime = DateTime.Now;
DateTime endTime = StartTime.AddSeconds(5);
PacketDotNet.ARPPacket arpPacket = null;
//接收5秒钟数据包，然后闪人
while (DateTime.Now <= endTime)
{
var reply = device.GetNextPacket();
if (reply == null)
{
continue;
}
var packet = PacketDotNet.Packet.ParsePacket(reply);
arpPacket = PacketDotNet.ARPPacket.GetEncapsulated(packet);
if (arpPacket == null)
{
continue;
}
else
{
//exists判断是否ARP回应包存在重复
bool exists = false;
foreach (Object obj in tmpArrayList)
{
ARPPacket tmp = (ARPPacket)obj;
if (arpPacket.SenderHardwareAddress == tmp.SenderHardwareAddress)
{
exists = true;
break;
}
}
if (exists == false)
{
tmpArrayList.Add(arpPacket);
}
}
}
device.Close();
return(tmpArrayList);
}
void listField(ref ARPPacket p)
{
addField("ARP", "Hardware Address Length", p.HardwareAddressLength.ToString(), ARPFields.AddressLengthLength);
addField("ARP", "Hardware Address Type", p.HardwareAddressType.ToString(),ARPFields.AddressTypeLength);
addField("ARP", "Operation", p);
addField("ARP", "Protocol Address Length", p.ProtocolAddressLength.ToString(), ARPFields.AddressLengthLength);
addField("Protocol Address Type",p.ProtocolAddressType,ARPFields.ProtocolAddressTypePosition, 2);
addField("Sender Hardware Address", p.SenderHardwareAddress.ToString(),ARPFields.SenderHardwareAddressPosition, p.HardwareAddressLength);
addField("Target Hardware Address", p.TargetHardwareAddress.ToString(), ARPFields.TargetHardwareAddressPosition, p.HardwareAddressLength);
addField("Sender Protocol Address", p.SenderProtocolAddress.ToString(), ARPFields.SenderProtocolAddressPosition, p.ProtocolAddressLength);
addField("Target Protocol Address", p.TargetProtocolAddress.ToString(), ARPFields.TargetProtocolAddressPosition, p.ProtocolAddressLength);
}
// create ARP request packet (destination IP, deviceInfo)
private EthernetPacket GenerateARPRequest(IPAddress destinationIP, IPAddress senderIP)
{
var ethernetPacket = new EthernetPacket(physicalAddress, broadcastMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Request, broadcastMAC, destinationIP, physicalAddress, senderIP);
ethernetPacket.PayloadPacket = arpPacket;
return ethernetPacket;
}
// create ARP reply packet (sender IP, target IP, target MAC, specific source MAC)
private EthernetPacket GenerateARPReply(string senderIP, string targetIP, PhysicalAddress targetMAC, PhysicalAddress sourceMAC)
{
var ethernetPacket = new EthernetPacket(physicalAddress, targetMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Response, targetMAC, IPAddress.Parse(targetIP), sourceMAC, IPAddress.Parse(senderIP));
ethernetPacket.PayloadPacket = arpPacket;
return ethernetPacket;
}
public static String ARPAnalyzor(ref TreeView tree, ARPPacket arp)
{
string info = "\r\n-------- ARP Header --------\r\n";
TreeNode ARPNode = new TreeNode("ARP(Address Resolusion Protocol) Header");
string hwtype, ptype, hwlen, plen, op, srchw, srcp, dsthw, dstp;
ARPNode.Nodes.Add(hwtype = "Hardware Type = " + arp.HardwareAddressType.ToString());
ARPNode.Nodes.Add(ptype = "Protocol Type = " + arp.ProtocolAddressType.ToString());
ARPNode.Nodes.Add(hwlen = "Hardware Length = " + arp.HardwareAddressLength.ToString());
ARPNode.Nodes.Add(plen = "Protocol Length = " + arp.ProtocolAddressLength.ToString());
ARPNode.Nodes.Add(op = "Operation = " + arp.Operation.ToString());
ARPNode.Nodes.Add(srchw = "Source Hardware Address = " + arp.SenderHardwareAddress.ToString());
ARPNode.Nodes.Add(srcp = "Source Protocol Address = " + arp.SenderProtocolAddress.ToString());
ARPNode.Nodes.Add(dsthw = "Destination Hardware Address = " + arp.TargetHardwareAddress.ToString());
ARPNode.Nodes.Add(dstp = "Destination Protocol Address = " + arp.TargetProtocolAddress.ToString());
tree.Nodes.Add(ARPNode);
info += hwtype + "\r\n" + ptype + "\r\n" + hwlen + "\r\n" + plen + "\r\n" + op + "\r\n";
info += srchw + "\r\n" + srcp + "\r\n" + dsthw + "\r\n" + dstp + "\r\n";
return info;
}