internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header,
PPPProtocol Protocol)
{
// slice off the payload
var payload = Header.EncapsulatedBytes();
var payloadPacketOrData = new PacketOrByteArraySegment();
switch (Protocol)
{
case PPPProtocol.IPv4:
payloadPacketOrData.ThePacket = new IPv4Packet(payload);
break;
case PPPProtocol.IPv6:
payloadPacketOrData.ThePacket = new IPv6Packet(payload);
break;
default:
throw new System.NotImplementedException("Protocol of " + Protocol + " is not implemented");
}
return(payloadPacketOrData);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public Ieee80211MacFrame(ByteArraySegment bas)
{
// slice off the header portion as our header
header = new ByteArraySegment(bas);
const int defaultLength = 4;
header.Length = defaultLength;
FrameControl = new Ieee80211FrameControlField(FrameControlBytes);
// determine what kind of frame this is based on the type
if (FrameControl.Types == Ieee80211FrameControlField.FrameTypes.ControlRTS)
{
InnerFrame = new RTSFrame(this, bas);
}
else if (FrameControl.Types == Ieee80211FrameControlField.FrameTypes.ControlCTS)
{
InnerFrame = new CTSOrACKFrame(this, bas);
}
else if (FrameControl.Types == Ieee80211FrameControlField.FrameTypes.ControlACK)
{
InnerFrame = new CTSOrACKFrame(this, bas);
}
else
{
throw new System.NotImplementedException("FrameControl.Types of " + FrameControl.Types + " not handled");
}
header.Length = InnerFrame.FrameSize;
// store the payload, less the frame check sequence at the end
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
payloadPacketOrData.TheByteArraySegment.Length -= Ieee80211MacFields.FrameCheckSequenceLength;
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header, EthernetPacketType Type, PosixTimeval Timeval)
{
ByteArraySegment segment = Header.EncapsulatedBytes();
PacketOrByteArraySegment segment2 = new PacketOrByteArraySegment();
EthernetPacketType type = Type;
if (type != EthernetPacketType.IpV4)
{
if (type == EthernetPacketType.Arp)
{
segment2.ThePacket = new ARPPacket(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
if (type == EthernetPacketType.IpV6)
{
segment2.ThePacket = new IPv6Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
if (type == EthernetPacketType.PointToPointProtocolOverEthernetSessionStage)
{
segment2.ThePacket = new PPPoEPacket(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
if (type == EthernetPacketType.LLDP)
{
segment2.ThePacket = new LLDPPacket(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
segment2.TheByteArraySegment = segment;
return(segment2);
}
segment2.ThePacket = new IPv4Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public UdpPacket(ByteArraySegment bas)
{
log.DebugFormat("bas {0}", bas.ToString());
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
RandomUtils.EnsurePacketLength(this, UdpFields.HeaderLength, header.Length);
header.Length = UdpFields.HeaderLength;
payloadPacketOrData = new PacketOrByteArraySegment();
// is this packet going to port 7 or 9? if so it might be a WakeOnLan packet
const int wakeOnLanPort0 = 7;
const int wakeOnLanPort1 = 9;
if (DestinationPort.Equals(wakeOnLanPort0) || DestinationPort.Equals(wakeOnLanPort1))
{
payloadPacketOrData.ThePacket = new WakeOnLanPacket(header.EncapsulatedBytes());
}
else
{
// store the payload bytes
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header,
NullPacketType Protocol)
{
// slice off the payload
var payload = Header.EncapsulatedBytes();
log.DebugFormat("Protocol: {0}, payload: {1}", Protocol, payload);
var payloadPacketOrData = new PacketOrByteArraySegment();
switch (Protocol)
{
case NullPacketType.IpV4:
payloadPacketOrData.ThePacket = new IPv4Packet(payload);
break;
case NullPacketType.IpV6:
case NullPacketType.IpV6_28:
case NullPacketType.IpV6_30:
payloadPacketOrData.ThePacket = new IPv6Packet(payload);
break;
case NullPacketType.IPX:
default:
throw new System.NotImplementedException("Protocol of " + Protocol + " is not implemented");
}
return(payloadPacketOrData);
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header, IPProtocolType ProtocolType, PosixTimeval Timeval, Packet ParentPacket)
{
ByteArraySegment segment = Header.EncapsulatedBytes();
PacketOrByteArraySegment segment2 = new PacketOrByteArraySegment();
IPProtocolType type = ProtocolType;
if (type == IPProtocolType.ICMP)
{
segment2.ThePacket = new ICMPv4Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
if (type != IPProtocolType.TCP)
{
if (type == IPProtocolType.UDP)
{
segment2.ThePacket = new UdpPacket(segment.Bytes, segment.Offset, Timeval, ParentPacket);
return(segment2);
}
if (type == IPProtocolType.ICMPV6)
{
segment2.ThePacket = new ICMPv6Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
segment2.TheByteArraySegment = segment;
return(segment2);
}
segment2.ThePacket = new TcpPacket(segment.Bytes, segment.Offset, Timeval, ParentPacket);
return(segment2);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public RawIPPacket(ByteArraySegment bas)
{
// Pcap raw link layer format does not have any header
// you need to identify whether you have ipv4 or ipv6
// directly by checking the IP version number.
// If the first nibble is 0x04, then you have IP v4
// If the first nibble is 0x06, then you have IP v6
// The RawIPPacketProtocol enum has been defined to match this.
var firstNibble = bas.Bytes[0] >> 4;
Protocol = (RawIPPacketProtocol)firstNibble;
header = new ByteArraySegment(bas);
header.Length = 0;
// parse the encapsulated bytes
payloadPacketOrData = new PacketOrByteArraySegment();
switch (Protocol)
{
case RawIPPacketProtocol.IPv4:
payloadPacketOrData.ThePacket = new IPv4Packet(header.EncapsulatedBytes());
break;
case RawIPPacketProtocol.IPv6:
payloadPacketOrData.ThePacket = new IPv6Packet(header.EncapsulatedBytes());
break;
default:
throw new System.NotImplementedException("Protocol of " + Protocol + " is not implemented");
}
}
/// <summary>
/// Called by IPv4 and IPv6 packets to parse their packet payload
/// </summary>
/// <param name="payload">
/// A <see cref="ByteArraySegment"/>
/// </param>
/// <param name="ProtocolType">
/// A <see cref="IPProtocolType"/>
/// </param>
/// <param name="ParentPacket">
/// A <see cref="Packet"/>
/// </param>
/// <returns>
/// A <see cref="PacketOrByteArraySegment"/>
/// </returns>
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload,
IPProtocolType ProtocolType,
Packet ParentPacket)
{
log.DebugFormat("payload: {0}, ParentPacket.GetType() {1}",
payload,
ParentPacket.GetType());
var payloadPacketOrData = new PacketOrByteArraySegment();
// if we are an ipv4 packet with a non-zero FragementOffset we shouldn't attempt
// to decode the content, it is a continuation of a previous packet so it won't
// have the proper headers for its type, that was in the first packet fragment
var ipv4Packet = ParentPacket.Extract(typeof(IPv4Packet)) as IPv4Packet;
if (ipv4Packet != null)
{
if (ipv4Packet.FragmentOffset > 0)
{
payloadPacketOrData.TheByteArraySegment = payload;
return(payloadPacketOrData);
}
}
switch (ProtocolType)
{
case IPProtocolType.TCP:
payloadPacketOrData.ThePacket = new TcpPacket(payload,
ParentPacket);
break;
case IPProtocolType.UDP:
payloadPacketOrData.ThePacket = new UdpPacket(payload,
ParentPacket);
break;
case IPProtocolType.ICMP:
payloadPacketOrData.ThePacket = new ICMPv4Packet(payload,
ParentPacket);
break;
case IPProtocolType.ICMPV6:
payloadPacketOrData.ThePacket = new ICMPv6Packet(payload,
ParentPacket);
break;
case IPProtocolType.IGMP:
payloadPacketOrData.ThePacket = new IGMPv2Packet(payload,
ParentPacket);
break;
// NOTE: new payload parsing entries go here
default:
payloadPacketOrData.TheByteArraySegment = payload;
break;
}
return(payloadPacketOrData);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public ICMPv4Packet(ByteArraySegment bas)
{
header = new ByteArraySegment(bas);
header.Length = ICMPv4Fields.HeaderLength;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="byteArraySegment">
/// A <see cref="ByteArraySegment" />
/// </param>
public UdpPacket(ByteArraySegment byteArraySegment)
{
Log.DebugFormat("ByteArraySegment {0}", byteArraySegment);
// set the header field, header field values are retrieved from this byte array
Header = new ByteArraySegment(byteArraySegment)
{
Length = UdpFields.HeaderLength
};
PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
const int wakeOnLanPort0 = 0;
const int wakeOnLanPort7 = 7;
const int wakeOnLanPort9 = 9;
const int l2TpPort = 1701;
const int teredoPort = 3544;
var result = new PacketOrByteArraySegment();
var destinationPort = DestinationPort;
var sourcePort = SourcePort;
var payload = Header.NextSegment();
// If this packet is going to port 0, 7 or 9, then it might be a WakeOnLan packet.
if ((destinationPort == wakeOnLanPort0) || (destinationPort == wakeOnLanPort7) || (destinationPort == wakeOnLanPort9))
{
if (WakeOnLanPacket.IsValid(payload))
{
result.Packet = new WakeOnLanPacket(payload);
return(result);
}
}
if ((destinationPort == l2TpPort) || (sourcePort == l2TpPort))
{
result.Packet = new L2tpPacket(payload, this);
return(result);
}
// Teredo encapsulates IPv6 traffic into UDP packets, parse out the bytes in the payload into packets.
// If it contains a IPV6 packet, it to this current packet as a payload.
// https://tools.ietf.org/html/rfc4380#section-5.1.1
if ((destinationPort == teredoPort) || (sourcePort == teredoPort))
{
if (ContainsIPv6Packet(payload))
{
result.Packet = new IPv6Packet(payload);
return(result);
}
}
// store the payload bytes
result.ByteArraySegment = payload;
return(result);
},
LazyThreadSafetyMode.PublicationOnly);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public IGMPv2Packet(ByteArraySegment bas)
{
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
header.Length = UdpFields.HeaderLength;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="byteArraySegment">
/// A <see cref="ByteArraySegment" />
/// </param>
/// <param name="parentPacket">
/// A <see cref="Packet" />
/// </param>
public TcpPacket
(
ByteArraySegment byteArraySegment,
Packet parentPacket)
{
Log.Debug("");
// set the header field, header field values are retrieved from this byte array
// ReSharper disable once UseObjectOrCollectionInitializer
Header = new ByteArraySegment(byteArraySegment);
// NOTE: we update the Length field AFTER the header field because
// we need the header to be valid to retrieve the value of DataOffset
Header.Length = DataOffset * 4;
// store the payload bytes
PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
ByteArraySegment = Header.NextSegment()
};
// if the parent packet is an IPv4Packet we need to adjust
// the payload length because it is possible for us to have
// X bytes of data but only (X - Y) bytes are actually valid
if (ParentPacket is IPv4Packet ipv4Parent)
{
// actual total length (tcp header + tcp payload)
var ipPayloadTotalLength = ipv4Parent.TotalLength - (ipv4Parent.HeaderLength * 4);
Log.DebugFormat("ipv4Parent.TotalLength {0}, ipv4Parent.HeaderLength {1}",
ipv4Parent.TotalLength,
ipv4Parent.HeaderLength * 4);
var newTcpPayloadLength = ipPayloadTotalLength - Header.Length;
Log.DebugFormat("Header.Length {0}, Current payload length: {1}, new payload length {2}",
Header.Length,
result.ByteArraySegment.Length,
newTcpPayloadLength);
// the length of the payload is the total payload length
// above, minus the length of the tcp header
result.ByteArraySegment.Length = newTcpPayloadLength;
DecodePayload(result);
}
return(result);
},
LazyThreadSafetyMode.PublicationOnly);
Log.DebugFormat("ParentPacket.GetType() {0}", parentPacket.GetType());
ParentPacket = parentPacket;
}
/// <summary>
/// Called by IPv4 and IPv6 packets to parse their packet payload
/// </summary>
/// <param name="payload">
/// A <see cref="ByteArraySegment" />
/// </param>
/// <param name="protocolType">
/// A <see cref="IPProtocolType" />
/// </param>
/// <param name="parentPacket">
/// A <see cref="Packet" />
/// </param>
/// <returns>
/// A <see cref="PacketOrByteArraySegment" />
/// </returns>
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload, IPProtocolType protocolType, Packet parentPacket)
{
Log.DebugFormat("payload: {0}, parentPacket.GetType() {1}", payload, parentPacket.GetType());
var payloadPacketOrData = new PacketOrByteArraySegment();
switch (protocolType)
{
case IPProtocolType.TCP:
payloadPacketOrData.ThePacket = new TcpPacket(payload, parentPacket);
break;
case IPProtocolType.UDP:
payloadPacketOrData.ThePacket = new UdpPacket(payload, parentPacket);
break;
case IPProtocolType.ICMP:
payloadPacketOrData.ThePacket = new ICMPv4Packet(payload, parentPacket);
break;
case IPProtocolType.ICMPV6:
payloadPacketOrData.ThePacket = new ICMPv6Packet(payload, parentPacket);
break;
case IPProtocolType.IGMP:
payloadPacketOrData.ThePacket = new IGMPv2Packet(payload, parentPacket);
break;
case IPProtocolType.GRE:
var grePacket = new GrePacket(payload, parentPacket);
payloadPacketOrData.ThePacket = grePacket;
//Packet.ParsePacket(LinkLayers.Raw, grePacket.PayloadData);
/*IpPacket packet = new IPv4Packet();
* if (packet == null)
* packet = null;*/
//tady si zduplikuji IpPacket a dam mu priznak virtualni. Realny necham jak je. Vytvorim z nej virtualni.
//vytvorim novy ramec a nastavim link layer ROW -> ParsePacket posledni moznost ve switchi
//Zdedit PmFrameBase konstruktor (byte[] packetData)
//Do PmCaptureBase pridam fci na AddVirtualFrame(odkaz na muj VirtualFrame)
break;
// NOTE: new payload parsing entries go here
default:
payloadPacketOrData.TheByteArraySegment = payload;
//gre.ParseEncapsulatedData(,,,gre);
break;
}
return(payloadPacketOrData);
}
public SctpPacket(ByteArraySegment bas)
{
this.Header = new ByteArraySegment(bas);
this.Header.Length = SctpFields.HeaderLength;
List <SctpChunk> foundSctpChunks;
PacketOrByteArraySegment parsed =
SctpPacket.ParseEncapsulatedBytes(this.Header, (Packet)this, out foundSctpChunks);
this.PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() => parsed);
this.PayloadChunks = foundSctpChunks;
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas"></param>
public DrdaPacket(ByteArraySegment bas)
{
log.Debug("");
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public UdpPacket(ByteArraySegment bas)
{
log.DebugFormat("bas {0}", bas.ToString());
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
header.Length = UdpFields.HeaderLength;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public ICMPv4Packet(ByteArraySegment bas)
{
log.Debug("");
header = new ByteArraySegment(bas);
RandomUtils.EnsurePacketLength(this, ICMPv4Fields.HeaderLength, header.Length);
header.Length = ICMPv4Fields.HeaderLength;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header)
{
// slice off the payload
var payload = Header.EncapsulatedBytes();
var payloadPacketOrData = new PacketOrByteArraySegment();
// we assume that we have a PPPPacket as the payload
payloadPacketOrData.ThePacket = new PPPPacket(payload);
return(payloadPacketOrData);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public TcpPacket(ByteArraySegment bas)
{
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
// NOTE: we update the Length field AFTER the header field because
// we need the header to be valid to retrieve the value of DataOffset
header.Length = DataOffset * 4;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Used by the EthernetPacket constructor. Located here because the LinuxSLL constructor
/// also needs to perform the same operations as it contains an ethernet type
/// </summary>
/// <param name="Header">
/// A <see cref="ByteArraySegment"/>
/// </param>
/// <param name="Type">
/// A <see cref="EthernetPacketType"/>
/// </param>
/// <returns>
/// A <see cref="PacketOrByteArraySegment"/>
/// </returns>
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header,
EthernetPacketType Type)
{
// slice off the payload
var payload = Header.EncapsulatedBytes();
log.DebugFormat("payload {0}", payload.ToString());
var payloadPacketOrData = new PacketOrByteArraySegment();
// parse the encapsulated bytes
switch (Type)
{
case EthernetPacketType.IpV4:
payloadPacketOrData.ThePacket = new IPv4Packet(payload);
break;
case EthernetPacketType.IpV6:
payloadPacketOrData.ThePacket = new IPv6Packet(payload);
break;
case EthernetPacketType.Arp:
payloadPacketOrData.ThePacket = new ARPPacket(payload);
break;
case EthernetPacketType.LLDP:
payloadPacketOrData.ThePacket = new LLDPPacket(payload);
break;
case EthernetPacketType.PointToPointProtocolOverEthernetSessionStage:
payloadPacketOrData.ThePacket = new PPPoEPacket(payload);
break;
case EthernetPacketType.WakeOnLan:
payloadPacketOrData.ThePacket = new WakeOnLanPacket(payload);
break;
case EthernetPacketType.VLanTaggedFrame:
payloadPacketOrData.ThePacket = new Ieee8021QPacket(payload);
break;
default: // consider the sub-packet to be a byte array
payloadPacketOrData.TheByteArraySegment = payload;
break;
}
return(payloadPacketOrData);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="byteArraySegment"></param>
public DrdaPacket(ByteArraySegment byteArraySegment)
{
Log.Debug("");
// set the header field, header field values are retrieved from this byte array
Header = new ByteArraySegment(byteArraySegment);
// store the payload bytes
PayloadPacketOrData = new LazySlim <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
ByteArraySegment = Header.NextSegment()
};
return(result);
});
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment" />
/// </param>
public IGMPv2Packet(ByteArraySegment bas)
{
// set the header field, header field values are retrieved from this byte array
// ReSharper disable once UseObjectOrCollectionInitializer
Header = new ByteArraySegment(bas);
Header.Length = UdpFields.HeaderLength;
// store the payload bytes
PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
ByteArraySegment = Header.EncapsulatedBytes()
};
return(result);
}, LazyThreadSafetyMode.PublicationOnly);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="byteArraySegment">
/// A <see cref="ByteArraySegment" />
/// </param>
public IgmpV2Packet(ByteArraySegment byteArraySegment)
{
// set the header field, header field values are retrieved from this byte array
// ReSharper disable once UseObjectOrCollectionInitializer
Header = new ByteArraySegment(byteArraySegment);
Header.Length = UdpFields.HeaderLength;
// store the payload bytes
PayloadPacketOrData = new LazySlim <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
ByteArraySegment = Header.NextSegment()
};
return(result);
});
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas"></param>
public DrdaPacket(ByteArraySegment bas)
{
log.Debug("");
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
// store the payload bytes
payloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
TheByteArraySegment = header.EncapsulatedBytes()
};
return(result);
});
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas"></param>
public DrdaPacket(ByteArraySegment bas)
{
Log.Debug("");
// set the header field, header field values are retrieved from this byte array
Header = new ByteArraySegment(bas);
// store the payload bytes
PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment {
ByteArraySegment = Header.EncapsulatedBytes()
};
return(result);
}, LazyThreadSafetyMode.PublicationOnly);
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public TcpPacket(ByteArraySegment bas)
{
log.Debug("");
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
RandomUtils.EnsurePacketLength(this, TcpPacket.HeaderMinimumLength, header.Length);
RandomUtils.EnsurePacketLength(this, DataOffset * 4, header.Length);
// NOTE: we update the Length field AFTER the header field because
// we need the header to be valid to retrieve the value of DataOffset
header.Length = DataOffset * 4;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="byteArraySegment">
/// A <see cref="ByteArraySegment" />
/// </param>
public RawIPPacket(ByteArraySegment byteArraySegment)
{
// Pcap raw link layer format does not have any header
// you need to identify whether you have ipv4 or ipv6
// directly by checking the IP version number.
// If the first nibble is 0x04, then you have IP v4
// If the first nibble is 0x06, then you have IP v6
// The RawIPPacketProtocol enum has been defined to match this.
var firstNibble = byteArraySegment.Bytes[0] >> 4;
Protocol = (RawIPPacketProtocol)firstNibble;
Header = new ByteArraySegment(byteArraySegment)
{
Length = 0
};
// parse the encapsulated bytes
PayloadPacketOrData = new Lazy <PacketOrByteArraySegment>(() =>
{
var result = new PacketOrByteArraySegment();
switch (Protocol)
{
case RawIPPacketProtocol.IPv4:
{
result.Packet = new IPv4Packet(Header.NextSegment());
break;
}
case RawIPPacketProtocol.IPv6:
{
result.Packet = new IPv6Packet(Header.NextSegment());
break;
}
default:
{
throw new NotImplementedException("Protocol of " + Protocol + " is not implemented");
}
}
return(result);
},
LazyThreadSafetyMode.PublicationOnly);
}
/// <summary>
/// Called by IPv4 and IPv6 packets to parse their packet payload
/// </summary>
/// <param name="payload">
/// A <see cref="ByteArraySegment"/>
/// </param>
/// <param name="ProtocolType">
/// A <see cref="IPProtocolType"/>
/// </param>
/// <param name="ParentPacket">
/// A <see cref="Packet"/>
/// </param>
/// <returns>
/// A <see cref="PacketOrByteArraySegment"/>
/// </returns>
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment payload,
IPProtocolType ProtocolType,
Packet ParentPacket)
{
log.DebugFormat("payload: {0}, ParentPacket.GetType() {1}",
payload,
ParentPacket.GetType());
var payloadPacketOrData = new PacketOrByteArraySegment();
switch (ProtocolType)
{
case IPProtocolType.TCP:
payloadPacketOrData.ThePacket = new TcpPacket(payload,
ParentPacket);
break;
case IPProtocolType.UDP:
payloadPacketOrData.ThePacket = new UdpPacket(payload,
ParentPacket);
break;
case IPProtocolType.ICMP:
payloadPacketOrData.ThePacket = new ICMPv4Packet(payload,
ParentPacket);
break;
case IPProtocolType.ICMPV6:
payloadPacketOrData.ThePacket = new ICMPv6Packet(payload,
ParentPacket);
break;
case IPProtocolType.IGMP:
payloadPacketOrData.ThePacket = new IGMPv2Packet(payload,
ParentPacket);
break;
// NOTE: new payload parsing entries go here
default:
payloadPacketOrData.TheByteArraySegment = payload;
break;
}
return(payloadPacketOrData);
}
private static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment header, Packet packet, out List <SctpChunk> foundSctpChunks)
{
foundSctpChunks = new List <SctpChunk>();
PacketOrByteArraySegment byteArraySegment = new PacketOrByteArraySegment();
ByteArraySegment bas = header.EncapsulatedBytes();
if (bas == null || bas.Length == 0)
{
return new PacketOrByteArraySegment()
{
ByteArraySegment = bas
}
}
;
for (; bas.Length > SctpChunkFields.HeaderLength; bas = bas.EncapsulatedBytes())
{
SctpChunk sctpChunk;
switch ((SctpChunkType)bas.Bytes[bas.Offset])
{
case SctpChunkType.Data:
sctpChunk = (SctpChunk) new SctpDataChunk(bas, packet);
break;
case SctpChunkType.Sack:
sctpChunk = (SctpChunk) new SctpSackChunk(bas, packet);
break;
default:
sctpChunk = (SctpChunk) new SctpUnsupportedChunk(bas, packet);
break;
}
foundSctpChunks.Insert(0, sctpChunk);
bas.Length = (int)sctpChunk.Length;
}
if (foundSctpChunks.Count == 1)
{
byteArraySegment.Packet = (Packet)foundSctpChunks.Single <SctpChunk>();
return(byteArraySegment);
}
byteArraySegment.ByteArraySegment = header.EncapsulatedBytes();
return(byteArraySegment);
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header, PosixTimeval Timeval, PPPProtocol Protocol)
{
ByteArraySegment segment = Header.EncapsulatedBytes();
PacketOrByteArraySegment segment2 = new PacketOrByteArraySegment();
PPPProtocol protocol = Protocol;
if (protocol != PPPProtocol.IPv4)
{
if (protocol != PPPProtocol.IPv6)
{
throw new NotImplementedException("Protocol of " + Protocol + " is not implemented");
}
}
else
{
segment2.ThePacket = new IPv4Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
segment2.ThePacket = new IPv6Packet(segment.Bytes, segment.Offset, Timeval);
return(segment2);
}
internal static PacketOrByteArraySegment ParseEncapsulatedBytes(ByteArraySegment Header, EthernetPacketType Type, PosixTimeval Timeval)
{
ByteArraySegment segment = Header.EncapsulatedBytes();
PacketOrByteArraySegment segment2 = new PacketOrByteArraySegment();
EthernetPacketType type = Type;
if (type != EthernetPacketType.IpV4)
{
if (type == EthernetPacketType.Arp)
{
segment2.ThePacket = new ARPPacket(segment.Bytes, segment.Offset, Timeval);
return segment2;
}
if (type == EthernetPacketType.IpV6)
{
segment2.ThePacket = new IPv6Packet(segment.Bytes, segment.Offset, Timeval);
return segment2;
}
if (type == EthernetPacketType.PointToPointProtocolOverEthernetSessionStage)
{
segment2.ThePacket = new PPPoEPacket(segment.Bytes, segment.Offset, Timeval);
return segment2;
}
if (type == EthernetPacketType.LLDP)
{
segment2.ThePacket = new LLDPPacket(segment.Bytes, segment.Offset, Timeval);
return segment2;
}
segment2.TheByteArraySegment = segment;
return segment2;
}
segment2.ThePacket = new IPv4Packet(segment.Bytes, segment.Offset, Timeval);
return segment2;
}
/// <summary>
/// Constructor
/// </summary>
/// <param name="bas">
/// A <see cref="ByteArraySegment"/>
/// </param>
public IGMPv2Packet(ByteArraySegment bas)
{
// set the header field, header field values are retrieved from this byte array
header = new ByteArraySegment(bas);
header.Length = UdpFields.HeaderLength;
// store the payload bytes
payloadPacketOrData = new PacketOrByteArraySegment();
payloadPacketOrData.TheByteArraySegment = header.EncapsulatedBytes();
}
