Exemplo n.º 1
0
        private static bool DumpFileInternal(string fileName)
        {
            if (fileName == null)
            {
                return(false);
            }
            NetmonCaptureFile file       = new NetmonCaptureFile(fileName);
            FileStream        fs         = new FileStream(System.IO.Path.ChangeExtension(fileName, ".txt"), FileMode.Create);
            StreamWriter      sw         = new StreamWriter(fs);
            SFSParser         respParser = new SFSParser(false, sw);
            SFSParser         reqParser  = new SFSParser(true, sw);
            NetMonFrameParser parser     = new NetMonFrameParser();

            parser.AddFiled("TCP.TCPPayload.TCPPayloadData");
            parser.AddFiled("TCP.SrcPort");
            parser.AddFiled("TCP.DstPort");
            parser.AddFiled("TCP.Flags");
            parser.AddFiled("IPv4.SourceAddress");
            parser.AddProperty("Property.TCPSeqNumber");
            parser.AddProperty("Property.TCPCheckSumStatus");

            for (uint i = 0; i < file.FrameCount; i++)
            {
                NetmonFrame frame = file.GetFrame(i);
                frame.Parser = parser;

                byte[] address = frame.GetFieldBuffer("IPv4.SourceAddress");

                if (address == null)
                {
                    continue;
                }

                bool isReq = (address[0] == 10 && address[1] == 10);

                if (!isReq)
                {
                    //某些情况下,请求的包的checksum交由网卡计算,导致此时抓包获取的checksum不正确,此时请求包应放行
                    string checksum = frame.GetPropertyString("Property.TCPCheckSumStatus");
                    if (checksum == "Bad")
                    {
                        continue;
                    }
                }


                {
                    byte flags = frame.GetFieldByte("TCP.Flags");

                    if ((flags & 0x02) == 0x02)//SYN
                    {
                        uint seq = frame.GetPropertyUint("Property.TCPSeqNumber");
                        if (isReq)
                        {
                            reqParser.Seq = seq + 1;
                        }
                        else
                        {
                            respParser.Seq = seq + 1;
                        }
                    }
                }

                {
                    byte[] buffer = frame.GetFieldBuffer("TCP.TCPPayload.TCPPayloadData");
                    if (buffer != null)
                    {
                        uint seq = frame.GetPropertyUint("Property.TCPSeqNumber");

                        if (isReq)
                        {
                            reqParser.ReadBuffer(buffer, seq);
                        }
                        else
                        {
                            respParser.ReadBuffer(buffer, seq);
                        }
                    }
                }
            }
            sw.Close();
            fs.Close();
            file.Close();
            return(true);
        }
Exemplo n.º 2
0
        private static bool DumpFileInternal(string fileName)
        {
            if (fileName == null)
                return false;
            NetmonCaptureFile file = new NetmonCaptureFile(fileName);
            FileStream fs = new FileStream(System.IO.Path.ChangeExtension(fileName, ".txt"), FileMode.Create);
            StreamWriter sw = new StreamWriter(fs);
            SFSParser respParser = new SFSParser(false, sw);
            SFSParser reqParser = new SFSParser(true, sw);
            NetMonFrameParser parser = new NetMonFrameParser();
            parser.AddFiled("TCP.TCPPayload.TCPPayloadData");
            parser.AddFiled("TCP.SrcPort");
            parser.AddFiled("TCP.DstPort");
            parser.AddFiled("TCP.Flags");
            parser.AddFiled("IPv4.SourceAddress");
            parser.AddProperty("Property.TCPSeqNumber");
            parser.AddProperty("Property.TCPCheckSumStatus");

            for (uint i = 0; i < file.FrameCount; i++)
            {
                NetmonFrame frame = file.GetFrame(i);
                frame.Parser = parser;

                byte[] address = frame.GetFieldBuffer("IPv4.SourceAddress");

                if (address == null)
                    continue;

                bool isReq = (address[0] == 10 && address[1] == 10);

                if (!isReq)
                {
                    //某些情况下,请求的包的checksum交由网卡计算,导致此时抓包获取的checksum不正确,此时请求包应放行
                    string checksum = frame.GetPropertyString("Property.TCPCheckSumStatus");
                    if (checksum == "Bad")
                        continue;
                }

                {
                    byte flags = frame.GetFieldByte("TCP.Flags");

                    if ((flags & 0x02) == 0x02)//SYN
                    {
                        uint seq = frame.GetPropertyUint("Property.TCPSeqNumber");
                        if (isReq)
                            reqParser.Seq = seq + 1;
                        else
                            respParser.Seq = seq + 1;
                    }
                }

                {
                    byte[] buffer = frame.GetFieldBuffer("TCP.TCPPayload.TCPPayloadData");
                    if (buffer != null)
                    {
                        uint seq = frame.GetPropertyUint("Property.TCPSeqNumber");

                        if (isReq)
                            reqParser.ReadBuffer(buffer, seq);
                        else
                            respParser.ReadBuffer(buffer, seq);
                    }
                }

            }
            sw.Close();
            fs.Close();
            file.Close();
            return true;
        }