// here we search through all the frag we have collected to see if one fits private bool checkFragments() { TcpFragment prev = null; TcpFragment current = _fragment; while (current != null) { if (current.sequenceNumber == _sequenceNumber) { // this fragment fits the stream _sequenceNumber += current.length; if (current.data != null) { writeData(current.data, current.ppacket, "next packet from fragments"); } //_sequenceNumber += current.length; if (prev != null) { prev.next = current.next; } else { _fragment = current.next; } current.data = null; current = null; return(true); } prev = current; current = current.next; } return(false); }
/* here we search through all the frag we have collected to see if one fits */ bool check_fragments(int index) { TcpFragment prev = null; TcpFragment current; current = _fragments[index]; while (current != null) { if (current.sequenceNumber == _sequenceNumbers[index]) { /* this fragment fits the stream */ if (current.data != null) { write_packet_data(index, current.data); } _sequenceNumbers[index] += current.length; if (prev != null) { prev.next = current.next; } else { _fragments[index] = current.next; } current.data = null; current = null; return(true); } prev = current; current = current.next; } return(false); }
private void reassemble_tcp(uint sequenceNumber, uint length, byte[] data, uint dataLength, bool synflag, uint sourceAdress, ushort sourcePort, uint destinationAdress, ushort destinationPort) { //long srcx, dstx; int src_index, j; bool first = false; //ulong newseq; uint newSequenceNumber; TcpFragment tmp_frag; src_index = -1; /* Now check if the packet is for this connection. */ uint srcx = sourceAdress; uint dstx = destinationAdress; /* Check to see if we have seen this source IP and port before. * (Yes, we have to check both source IP and port; the connection * might be between two different ports on the same machine.) */ for (j = 0; j < 2; j++) { if (_sourceAdresses[j] == srcx && _sourcePorts[j] == sourcePort) { src_index = j; } } /* we didn't find it if src_index == -1 */ if (src_index < 0) { /* assign it to a src_index and get going */ for (j = 0; j < 2; j++) { if (_sourcePorts[j] == 0) { _sourceAdresses[j] = srcx; _sourcePorts[j] = sourcePort; src_index = j; first = true; break; } } } if (src_index < 0) { throw new Exception("ERROR in reassemble_tcp: Too many addresses!"); } if (dataLength < length) { _incompleteTcpStream = true; } /* now that we have filed away the srcs, lets get the sequence number stuff * figured out */ if (first) { /* this is the first time we have seen this src's sequence number */ _sequenceNumbers[src_index] = sequenceNumber + length; if (synflag) { _sequenceNumbers[src_index]++; } /* write out the packet data */ write_packet_data(src_index, data); return; } /* if we are here, we have already seen this src, let's * try and figure out if this packet is in the right place */ if (sequenceNumber < _sequenceNumbers[src_index]) { /* this sequence number seems dated, but * check the end to make sure it has no more * info than we have already seen */ newSequenceNumber = sequenceNumber + length; if (newSequenceNumber > _sequenceNumbers[src_index]) { //ulong new_len; uint new_len; /* this one has more than we have seen. let's get the * payload that we have not seen. */ new_len = _sequenceNumbers[src_index] - sequenceNumber; if (dataLength <= new_len) { data = null; dataLength = 0; _incompleteTcpStream = true; } else { dataLength -= new_len; byte[] tmpData = new byte[dataLength]; for (ulong i = 0; i < dataLength; i++) { tmpData[i] = data[i + new_len]; } data = tmpData; } sequenceNumber = _sequenceNumbers[src_index]; length = newSequenceNumber - _sequenceNumbers[src_index]; /* this will now appear to be right on time :) */ } } if (sequenceNumber == _sequenceNumbers[src_index]) { /* right on time */ _sequenceNumbers[src_index] += length; if (synflag) { _sequenceNumbers[src_index]++; } if (data != null) { write_packet_data(src_index, data); } /* done with the packet, see if it caused a fragment to fit */ while (check_fragments(src_index)) { ; } } else { /* out of order packet */ if (dataLength > 0 && sequenceNumber > _sequenceNumbers[src_index]) { tmp_frag = new TcpFragment(); tmp_frag.data = data; tmp_frag.sequenceNumber = sequenceNumber; tmp_frag.length = length; tmp_frag.dataLength = dataLength; if (_fragments[src_index] != null) { tmp_frag.next = _fragments[src_index]; } else { tmp_frag.next = null; } _fragments[src_index] = tmp_frag; } } }
// here we search through all the frag we have collected to see if one fits private bool checkFragments() { TcpFragment prev = null; TcpFragment current = _fragment; while (current != null) { if (current.sequenceNumber == _sequenceNumber) { // this fragment fits the stream _sequenceNumber += current.length; if (current.data != null) writeData(current.data, current.ppacket, "next packet from fragments"); //_sequenceNumber += current.length; if (prev != null) prev.next = current.next; else _fragment = current.next; current.data = null; current = null; return true; } prev = current; current = current.next; } return false; }
public void Add(Packet packet) { _packet = packet; TcpDatagram tcp = packet.Ethernet.IpV4.Tcp; // if the paylod length is zero bail out uint length = (uint)tcp.PayloadLength; if (length == 0) return; //uint dataLength byte[] data = tcp.Payload.ToArray(); uint dataLength = (uint)data.Length; if (dataLength < length) _incompleteTcpStream = true; uint sequenceNumber = tcp.SequenceNumber; // now that we have filed away the srcs, lets get the sequence number stuff figured out if (_first) { // this is the first time we have seen this src's sequence number _sequenceNumber = sequenceNumber + length; if (tcp.IsSynchronize) _sequenceNumber++; if (!(!tcp.IsPush && dataLength == 1 && length == 1 && data[0] == 0)) writeData(data, _ppacket, "first packet"); _first = false; return; } // if we are here, we have already seen this src, let's try and figure out if this packet is in the right place if (sequenceNumber < _sequenceNumber) { // this sequence number seems dated, but check the end to make sure it has no more info than we have already seen uint newSequenceNumber = sequenceNumber + length; if (newSequenceNumber > _sequenceNumber) { // this one has more than we have seen. let's get the payload that we have not seen. uint new_len = _sequenceNumber - sequenceNumber; if (dataLength <= new_len) { data = null; dataLength = 0; _incompleteTcpStream = true; } else { dataLength -= new_len; byte[] tmpData = new byte[dataLength]; for (uint i = 0; i < dataLength; i++) tmpData[i] = data[i + new_len]; data = tmpData; } sequenceNumber = _sequenceNumber; length = newSequenceNumber - _sequenceNumber; // this will now appear to be right on time :) } } if (sequenceNumber == _sequenceNumber) { // right on time _sequenceNumber += length; if (tcp.IsSynchronize) _sequenceNumber++; if (data != null) writeData(data, _ppacket, "next packet"); // done with the packet, see if it caused a fragment to fit while (checkFragments()) ; } else { // out of order packet if (dataLength > 0 && sequenceNumber > _sequenceNumber) { TcpFragment tmp_frag = new TcpFragment(); tmp_frag.data = data; tmp_frag.sequenceNumber = sequenceNumber; tmp_frag.length = length; tmp_frag.dataLength = dataLength; tmp_frag.ppacket = _ppacket; if (_fragment != null) tmp_frag.next = _fragment; else tmp_frag.next = null; _fragment = tmp_frag; } } }
private void reassemble_tcp(uint sequenceNumber, uint length, byte[] data, uint dataLength, bool synflag, uint sourceAdress, ushort sourcePort, uint destinationAdress, ushort destinationPort) { //long srcx, dstx; int src_index, j; bool first = false; //ulong newseq; uint newSequenceNumber; TcpFragment tmp_frag; src_index = -1; /* Now check if the packet is for this connection. */ uint srcx = sourceAdress; uint dstx = destinationAdress; /* Check to see if we have seen this source IP and port before. (Yes, we have to check both source IP and port; the connection might be between two different ports on the same machine.) */ for (j = 0; j < 2; j++) { if (_sourceAdresses[j] == srcx && _sourcePorts[j] == sourcePort) { src_index = j; } } /* we didn't find it if src_index == -1 */ if (src_index < 0) { /* assign it to a src_index and get going */ for (j = 0; j < 2; j++) { if (_sourcePorts[j] == 0) { _sourceAdresses[j] = srcx; _sourcePorts[j] = sourcePort; src_index = j; first = true; break; } } } if (src_index < 0) { throw new Exception("ERROR in reassemble_tcp: Too many addresses!"); } if (dataLength < length) { _incompleteTcpStream = true; } /* now that we have filed away the srcs, lets get the sequence number stuff figured out */ if (first) { /* this is the first time we have seen this src's sequence number */ _sequenceNumbers[src_index] = sequenceNumber + length; if (synflag) { _sequenceNumbers[src_index]++; } /* write out the packet data */ write_packet_data(src_index, data); return; } /* if we are here, we have already seen this src, let's try and figure out if this packet is in the right place */ if (sequenceNumber < _sequenceNumbers[src_index]) { /* this sequence number seems dated, but check the end to make sure it has no more info than we have already seen */ newSequenceNumber = sequenceNumber + length; if (newSequenceNumber > _sequenceNumbers[src_index]) { //ulong new_len; uint new_len; /* this one has more than we have seen. let's get the payload that we have not seen. */ new_len = _sequenceNumbers[src_index] - sequenceNumber; if (dataLength <= new_len) { data = null; dataLength = 0; _incompleteTcpStream = true; } else { dataLength -= new_len; byte[] tmpData = new byte[dataLength]; for (ulong i = 0; i < dataLength; i++) tmpData[i] = data[i + new_len]; data = tmpData; } sequenceNumber = _sequenceNumbers[src_index]; length = newSequenceNumber - _sequenceNumbers[src_index]; /* this will now appear to be right on time :) */ } } if (sequenceNumber == _sequenceNumbers[src_index]) { /* right on time */ _sequenceNumbers[src_index] += length; if (synflag) _sequenceNumbers[src_index]++; if (data != null) { write_packet_data(src_index, data); } /* done with the packet, see if it caused a fragment to fit */ while (check_fragments(src_index)) ; } else { /* out of order packet */ if (dataLength > 0 && sequenceNumber > _sequenceNumbers[src_index]) { tmp_frag = new TcpFragment(); tmp_frag.data = data; tmp_frag.sequenceNumber = sequenceNumber; tmp_frag.length = length; tmp_frag.dataLength = dataLength; if (_fragments[src_index] != null) { tmp_frag.next = _fragments[src_index]; } else { tmp_frag.next = null; } _fragments[src_index] = tmp_frag; } } }
public void Add(Packet packet) { _packet = packet; TcpDatagram tcp = packet.Ethernet.IpV4.Tcp; // if the paylod length is zero bail out uint length = (uint)tcp.PayloadLength; if (length == 0) { return; } //uint dataLength byte[] data = tcp.Payload.ToArray(); uint dataLength = (uint)data.Length; if (dataLength < length) { _incompleteTcpStream = true; } uint sequenceNumber = tcp.SequenceNumber; // now that we have filed away the srcs, lets get the sequence number stuff figured out if (_first) { // this is the first time we have seen this src's sequence number _sequenceNumber = sequenceNumber + length; if (tcp.IsSynchronize) { _sequenceNumber++; } if (!(!tcp.IsPush && dataLength == 1 && length == 1 && data[0] == 0)) { writeData(data, _ppacket, "first packet"); } _first = false; return; } // if we are here, we have already seen this src, let's try and figure out if this packet is in the right place if (sequenceNumber < _sequenceNumber) { // this sequence number seems dated, but check the end to make sure it has no more info than we have already seen uint newSequenceNumber = sequenceNumber + length; if (newSequenceNumber > _sequenceNumber) { // this one has more than we have seen. let's get the payload that we have not seen. uint new_len = _sequenceNumber - sequenceNumber; if (dataLength <= new_len) { data = null; dataLength = 0; _incompleteTcpStream = true; } else { dataLength -= new_len; byte[] tmpData = new byte[dataLength]; for (uint i = 0; i < dataLength; i++) { tmpData[i] = data[i + new_len]; } data = tmpData; } sequenceNumber = _sequenceNumber; length = newSequenceNumber - _sequenceNumber; // this will now appear to be right on time :) } } if (sequenceNumber == _sequenceNumber) { // right on time _sequenceNumber += length; if (tcp.IsSynchronize) { _sequenceNumber++; } if (data != null) { writeData(data, _ppacket, "next packet"); } // done with the packet, see if it caused a fragment to fit while (checkFragments()) { ; } } else { // out of order packet if (dataLength > 0 && sequenceNumber > _sequenceNumber) { TcpFragment tmp_frag = new TcpFragment(); tmp_frag.data = data; tmp_frag.sequenceNumber = sequenceNumber; tmp_frag.length = length; tmp_frag.dataLength = dataLength; tmp_frag.ppacket = _ppacket; if (_fragment != null) { tmp_frag.next = _fragment; } else { tmp_frag.next = null; } _fragment = tmp_frag; } } }