private void getHosts()
{
//获取列表大概耗时35秒
packetArrayList = utility.ARPBroadcast(utility.getLiveDevice());
int ItemIndex = 0;
foreach (Object obj in packetArrayList)
{
ARPPacket pkt = (ARPPacket)obj;
string srcIP = pkt.SenderProtocolAddress.ToString();
IPHostEntry entry = Dns.GetHostEntry(pkt.SenderProtocolAddress);
string hostName = entry.HostName;
//各项逐个添加的原因是解析HostName耗时不同
ListViewItem tmp = new ListViewItem();
tmp.Text = ItemIndex.ToString();
tmp.SubItems.Add(hostName);
tmp.SubItems.Add(pkt.SenderProtocolAddress.ToString());
tmp.SubItems.Add(pkt.SenderHardwareAddress.ToString());
//若源MAC已有对应注释，加载之
string[] commentItem = File.ReadAllLines(commentFile);
for (int i = 0; i < commentItem.Length; i++)
{
if (commentItem[i].Substring(0, 12) == pkt.SenderHardwareAddress.ToString())
{
string tmpComment = commentItem[i].Substring(13);
tmp.SubItems.Add(tmpComment);
tmp.BackColor = Color.BurlyWood;
}
}
lstHost.Items.Insert(ItemIndex, tmp);
ItemIndex++;
}
this.pbScan.Value = pbScan.Maximum;
MessageBox.Show("数据包捕获完毕！");
}
private EthernetPacket aARPPacket()
{
string strEthDestMAC = txtEhDestMac.Text;
string strEhSourMac = txtEhSourMac.Text;
string strARPSourIP = txtARPSourIP.Text;
string strARPSourMac = txtARPSourMac.Text;
string strARPDestIP = txtARPDestIP.Text;
string strARPDestMac = txtARPDestMac.Text;
if (rdoReq.Checked)
{
ARPPacket arp = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse(strARPDestMac), IPAddress.Parse(strARPDestIP), PhysicalAddress.Parse(strARPSourMac), IPAddress.Parse(strARPSourIP));
EthernetPacket eth = new EthernetPacket(PhysicalAddress.Parse(strEhSourMac), PhysicalAddress.Parse(strEthDestMAC), EthernetPacketType.Arp);
eth.PayloadPacket = arp;
return(eth);
}
else
{
ARPPacket arp = new ARPPacket(ARPOperation.Response, PhysicalAddress.Parse(strARPDestMac), IPAddress.Parse(strARPDestIP), PhysicalAddress.Parse(strARPSourMac), IPAddress.Parse(strARPSourIP));
EthernetPacket eth = new EthernetPacket(PhysicalAddress.Parse(strEhSourMac), PhysicalAddress.Parse(strEthDestMAC), EthernetPacketType.Arp);
eth.PayloadPacket = arp;
return(eth);
}
}
public static Packet BuildArpReply(PhysicalAddress srcMAC, PhysicalAddress dstMAC, IPAddress senderIP, IPAddress targetIP, PhysicalAddress senderMAC, PhysicalAddress targetMAC, int vlanID)
{
EthernetPacket ePacket = new EthernetPacket(srcMAC, dstMAC, EthernetPacketType.Arp);
ARPPacket aPacket = new ARPPacket(ARPOperation.Response, targetMAC, targetIP, senderMAC, senderIP);
return(PacketBuilder.BuildPacket(vlanID, ePacket, aPacket));
}
public static void Disconnect(IView view, Dictionary <IPAddress, PhysicalAddress> targetlist, IPAddress gatewayipaddress, PhysicalAddress gatewaymacaddress, string interfacefriendlyname)
{
engagedclientlist = new Dictionary <IPAddress, PhysicalAddress>();
capturedevice = (from devicex in CaptureDeviceList.Instance where ((SharpPcap.WinPcap.WinPcapDevice)devicex).Interface.FriendlyName == interfacefriendlyname select devicex).ToList()[0];
capturedevice.Open();
foreach (var target in targetlist)
{
IPAddress myipaddress = ((SharpPcap.WinPcap.WinPcapDevice)capturedevice).Addresses[1].Addr.ipAddress; //possible critical point : Addresses[1] in hardcoding the index for obtaining ipv4 address
ARPPacket arppacketforgatewayrequest = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse("00-00-00-00-00-00"), gatewayipaddress, capturedevice.MacAddress, target.Key);
EthernetPacket ethernetpacketforgatewayrequest = new EthernetPacket(capturedevice.MacAddress, gatewaymacaddress, EthernetPacketType.Arp);
ethernetpacketforgatewayrequest.PayloadPacket = arppacketforgatewayrequest;
new Thread(() =>
{
disengageflag = false;
DebugOutputClass.Print(view, "Spoofing target " + target.Value.ToString() + " @ " + target.Key.ToString());
try
{
while (!disengageflag)
{
capturedevice.SendPacket(ethernetpacketforgatewayrequest);
}
}
catch (PcapException ex)
{
DebugOutputClass.Print(view, "PcapException @ DisconnectReconnect.Disconnect() [" + ex.Message + "]");
}
DebugOutputClass.Print(view, "Spoofing thread @ DisconnectReconnect.Disconnect() for " + target.Value.ToString() + " @ " + target.Key.ToString() + " is terminating.");
}).Start();
engagedclientlist.Add(target.Key, target.Value);
}
;
}
/// <summary>
/// Generate and return an ARP packet
/// </summary>
/// <param name="from">The FROM address to be used in the ARP layer (user)</param>
/// <param name="to">The TO address (gateway)</param>
/// <param name="mFrom">The MAC address of the user (or attacker)</param>
/// <param name="mTo">The MAC address of the gateway</param>
/// <returns></returns>
private ARPPacket generateARP(IPAddress from, IPAddress to, PhysicalAddress mFrom, PhysicalAddress mTo)
{
// build the ethernet layer packet
EthPacket eth = new EthPacket(42);
eth.FromMac = mFrom.GetAddressBytes();
eth.ToMac = mTo.GetAddressBytes();
eth.Proto = new byte[2] {
0x08, 0x06
};
// build the arp
ARPPacket arp = new ARPPacket(eth);
arp.HardwareSize = 6;
arp.HardwareType = 1;
arp.ProtocolType = 0x0800;
arp.ProtocolSize = 4;
arp.ASenderIP = from;
arp.ATargetIP = to;
arp.ASenderMac = mFrom.GetAddressBytes();
arp.ATargetMac = mTo.GetAddressBytes();
arp.Outbound = true;
arp.ProtocolSize = 0x04;
// mark it REPLY
arp.ARPOpcode = 2;
return(arp);
}
/**
* Process packets when they arrive
*/
private void device_onPacketArrival(Object sender, CaptureEventArgs packet)
{
try
{
String address = null, protocol = null;
// Convert the packet data from a byte array to a EthernetPacket instance
EthernetPacket ethernetPacket = (EthernetPacket)Packet.ParsePacket(packet.Packet.LinkLayerType, packet.Packet.Data);
// IPv4
if (ethernetPacket.PayloadPacket is IPv4Packet)
{
IPv4Packet ip = (IPv4Packet)ethernetPacket.PayloadPacket;
address = ip.SourceAddress.ToString();
protocol = ip.Protocol.ToString();
}
// IPv6
else if (ethernetPacket.PayloadPacket is IPv6Packet)
{
IPv6Packet ip = (IPv6Packet)ethernetPacket.PayloadPacket;
// Convert address to IPv4 since the GeoIP database we're using doesn't support IPv6 lookups
address = ip.SourceAddress.MapToIPv4().ToString();
protocol = ip.Protocol.ToString();
}
// ARP
else if (ethernetPacket.PayloadPacket is ARPPacket)
{
ARPPacket arp = (ARPPacket)ethernetPacket.PayloadPacket;
address = arp.SenderProtocolAddress.ToString();
// Check if this is a gratuitious ARP
checkForGratuitiousArp(arp);
protocol = "ARP";
}
// Other
else
{
// Don't care about other packet types
return;
}
// We care about this packet, so the packet counter can increment
numPackets++;
// If we haven't processes this IP address yet, add it to the address queue
if (address != null && !addedAddresses.Contains(address) && !pendingAddresses.ContainsKey(address))
{
pendingAddresses.Add(address, protocol);
}
} catch (Exception)
{
// Handle issues gracefully
}
}
private bool TryHandleArp(ARPPacket packet, out ARPPacket response)
{
response = null;
this.Log(LogLevel.Noisy, "Handling ARP packet: {0}", packet);
if (packet.Operation != ARPOperation.Request)
{
this.Log(LogLevel.Warning, "Unsupported ARP packet: {0}", packet);
return(false);
}
if (!packet.TargetProtocolAddress.Equals(IP))
{
this.Log(LogLevel.Noisy, "This ARP packet is not directed to me. Ignoring");
return(false);
}
response = new ARPPacket(
ARPOperation.Response,
packet.SenderHardwareAddress,
packet.SenderProtocolAddress,
(PhysicalAddress)MAC,
IP);
this.Log(LogLevel.Noisy, "Sending ARP response");
return(true);
}
/// <summary>
/// 设备扫描发包线程。
/// </summary>
/// <param name="obj">地址列表。</param>
private void ScanPacketSendThread(object obj)
{
try {
// 获取当前设备
var device = DeviceList[CurDevName];
// 获取地址列表
var ipAddresses = (List <IPAddress>)obj;
// 构建包信息
var ether = new EthernetPacket(device.MacAddress,
new PhysicalAddress(new byte[] { 255, 255, 255, 255, 255, 255 }),
EthernetPacketType.Arp);
var arp = new ARPPacket(ARPOperation.Request,
new PhysicalAddress(new byte[] { 0, 0, 0, 0, 0, 0 }),
new IPAddress(new byte[] { 0, 0, 0, 0 }),
device.MacAddress,
Ipv4Address)
{
HardwareAddressType = LinkLayers.Ethernet,
ProtocolAddressType = EthernetPacketType.IPv4
};
ether.PayloadPacket = arp;
arp.ParentPacket = ether;
// 根据目标地址信息发送ARP请求
foreach (var targetAddress in ipAddresses)
{
arp.TargetProtocolAddress = targetAddress;
arp.UpdateCalculatedValues();
device.SendPacket(ether);
}
}
catch (ThreadAbortException) { }
}
public void BinarySerialization()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/arp_request_response.pcap");
dev.Open();
RawCapture rawCapture;
Boolean foundARP = false;
while ((rawCapture = dev.GetNextPacket()) != null)
{
var p = PacketDotNet.Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
var arpPacket = (ARPPacket)p.Extract(typeof(ARPPacket));
if (arpPacket == null)
{
continue;
}
foundARP = true;
var memoryStream = new MemoryStream();
BinaryFormatter serializer = new BinaryFormatter();
serializer.Serialize(memoryStream, arpPacket);
memoryStream.Seek(0, SeekOrigin.Begin);
BinaryFormatter deserializer = new BinaryFormatter();
ARPPacket fromFile = (ARPPacket)deserializer.Deserialize(memoryStream);
CollectionAssert.AreEqual(arpPacket.Bytes, fromFile.Bytes);
Assert.AreEqual(arpPacket.BytesHighPerformance.Bytes, fromFile.BytesHighPerformance.Bytes);
Assert.AreEqual(arpPacket.BytesHighPerformance.BytesLength, fromFile.BytesHighPerformance.BytesLength);
Assert.AreEqual(arpPacket.BytesHighPerformance.Length, fromFile.BytesHighPerformance.Length);
Assert.AreEqual(arpPacket.BytesHighPerformance.NeedsCopyForActualBytes, fromFile.BytesHighPerformance.NeedsCopyForActualBytes);
Assert.AreEqual(arpPacket.BytesHighPerformance.Offset, fromFile.BytesHighPerformance.Offset);
Assert.AreEqual(arpPacket.Color, fromFile.Color);
Assert.AreEqual(arpPacket.HardwareAddressLength, fromFile.HardwareAddressLength);
Assert.AreEqual(arpPacket.HardwareAddressType, fromFile.HardwareAddressType);
CollectionAssert.AreEqual(arpPacket.HeaderData, fromFile.HeaderData);
Assert.AreEqual(arpPacket.Operation, fromFile.Operation);
Assert.AreEqual(arpPacket.ParentPacket, fromFile.ParentPacket);
CollectionAssert.AreEqual(arpPacket.PayloadData, fromFile.PayloadData);
Assert.AreEqual(arpPacket.PayloadPacket, fromFile.PayloadPacket);
Assert.AreEqual(arpPacket.ProtocolAddressLength, fromFile.ProtocolAddressLength);
Assert.AreEqual(arpPacket.ProtocolAddressType, fromFile.ProtocolAddressType);
Assert.AreEqual(arpPacket.SenderHardwareAddress, fromFile.SenderHardwareAddress);
Assert.AreEqual(arpPacket.SenderProtocolAddress, fromFile.SenderProtocolAddress);
Assert.AreEqual(arpPacket.TargetHardwareAddress, fromFile.TargetHardwareAddress);
Assert.AreEqual(arpPacket.TargetProtocolAddress, fromFile.TargetProtocolAddress);
//Method Invocations to make sure that a deserialized packet does not cause
//additional errors.
arpPacket.PrintHex();
arpPacket.UpdateCalculatedValues();
}
dev.Close();
Assert.IsTrue(foundARP, "Capture file contained no ARP packets");
}
void pasiveScan_NewARP(object sender, Core.ArpEventArgs e)
{
if (e.p == null)
{
return;
}
Packet p = e.p;
if (!(p.PayloadPacket is ARPPacket))
{
return;
}
ARPPacket arp = (ARPPacket)p.PayloadPacket;
foreach (Data.Attack attack in attacks.Where(A => A.attackType == Data.AttackType.InvalidMacSpoofIpv4 && A.attackStatus == Data.AttackStatus.Attacking))
{
if (attack is InvalidMacSpoofAttackIpv4Attack)
{
InvalidMacSpoofAttackIpv4Attack spoofAttack = (InvalidMacSpoofAttackIpv4Attack)attack;
if ((spoofAttack.t1.mac.Equals(arp.SenderHardwareAddress)) && arp.TargetProtocolAddress.Equals(spoofAttack.t2.ip))
{
ForceAttack(spoofAttack);
}
}
}
}
private static void HandleArpPacket(ARPPacket arpPacket)
{
if (Properties.Settings.Default.DiscoveryMode)
{
Console.WriteLine(arpPacket);
}
if (arpPacket.SenderHardwareAddress.Equals(dashMac))
{
Console.WriteLine(DateTime.Now + " Dash ARP");
// Dash seems to send two ARP packets per button press, one second apart.
// Dash device is active (blinking) for about 10 seconds after button press,
// and doesn't allow another press for another 25 seconds.
// 36 seconds after the initial push, the device sends the same two ARP packets.
var now = DateTime.Now;
if (now - Properties.Settings.Default.DuplicateIgnoreInterval > lastEventTime)
{
lastEventTime = now;
Console.WriteLine("Dash button event");
// TODO: What to do here?
}
}
}
private bool is_injected_packet_to_be_filtered(ref ARPPacket p_arp, ref IPv4Packet p_ipv4, ref UdpPacket p_udp, ref TcpPacket p_tcp)
{
// FILTER ARP PACKETS
if (p_arp != null)
{
// FILTER ARP PACKETS TO OR FROM GATEWAY IPs
foreach (IPAddress ip in gateway_ips)
{
if (p_arp.TargetProtocolAddress.Equals(ip))
{
return(true);
}
else if (p_arp.SenderProtocolAddress.Equals(ip))
{
return(true);
}
}
}
// FILTER IPv4 PACKETS
if (p_ipv4 != null)
{
// FILTER IP PACKETS TO OR FROM GATEWAY IPs
if (pdev_filter_exclude_gatway_ips)
{
foreach (IPAddress ip in gateway_ips)
{
if (p_ipv4.DestinationAddress.Equals(ip))
{
return(true);
}
else if (p_ipv4.SourceAddress.Equals(ip))
{
return(true);
}
}
}
}
// FILTER UDP PACKETS
if (p_udp != null)
{
// FILTER UDP PACKETS TO WELL KNOWN PORTS
if (pdev_filter_wellknown_ports && p_udp.DestinationPort < 1024)
{
return(true);
}
}
// FILTER TCP PACKETS
if (p_tcp != null)
{
// FILTER TCP PACKETS TO WELL KNOWN PORTS
if (pdev_filter_wellknown_ports && p_tcp.DestinationPort < 1024)
{
return(true);
}
}
return(false);
}
public static EthernetPacket Protect_Arp(string Router_mac, string My_pc_mac, string Router_ip, string My_pc_ip)
{
var eth = new EthernetPacket(PhysicalAddress.Parse(Router_mac), PhysicalAddress.Parse(My_pc_mac), EthernetPacketType.Arp);
var arp = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse(My_pc_mac), IPAddress.Parse(My_pc_ip), PhysicalAddress.Parse(Router_mac), IPAddress.Parse(Router_ip));
eth.PayloadPacket = arp;
return(eth);
}
private Packet BuildResponse(IPAddress destIP, PhysicalAddress destMac, IPAddress senderIP, PhysicalAddress senderMac)
{
var ethernetPacket = new EthernetPacket(senderMac, destMac, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Response, destMac, destIP, senderMac, senderIP);
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
private static EthernetPacket CreateARPRequest(IPAddress sourceAddress, PhysicalAddress sourceMAC, IPAddress destinationAddress)
{
var ethernetPacket = new EthernetPacket(sourceMAC, BroadcastMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Request, BroadcastMAC, destinationAddress, sourceMAC, sourceAddress);
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
// create ARP reply packet (sender IP, target IP, target MAC, specific source MAC)
private EthernetPacket GenerateARPReply(string senderIP, string targetIP, PhysicalAddress targetMAC, PhysicalAddress sourceMAC)
{
var ethernetPacket = new EthernetPacket(physicalAddress, targetMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Response, targetMAC, IPAddress.Parse(targetIP), sourceMAC, IPAddress.Parse(senderIP));
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
// create ARP request packet (destination IP, deviceInfo)
private EthernetPacket GenerateARPRequest(IPAddress destinationIP, IPAddress senderIP)
{
var ethernetPacket = new EthernetPacket(physicalAddress, broadcastMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Request, broadcastMAC, destinationIP, physicalAddress, senderIP);
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
private EthernetPacket GenerateARPReply(IPAddress sourceAddress, PhysicalAddress sourceMAC, IPAddress targetAddress, PhysicalAddress targetMAC, PhysicalAddress ethernetSourceMAC)
{
var ethernetPacket = new EthernetPacket(ethernetSourceMAC, targetMAC, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(ARPOperation.Response, targetMAC, targetAddress, sourceMAC, sourceAddress);
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
public static void SendARPresponse(ICaptureDevice device, IPAddress srcIP, IPAddress dstIP, PhysicalAddress srcMac, PhysicalAddress dstMac)
{
ARPPacket arp = new ARPPacket(ARPOperation.Response, dstMac, dstIP, srcMac, srcIP);
EthernetPacket eth = new EthernetPacket(srcMac, dstMac, EthernetPacketType.Arp);
arp.PayloadData = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
eth.PayloadPacket = arp;
device.SendPacket(eth);
}
private Packet CreateArpPacket(IPAddress senderIpAddress, PhysicalAddress senderPhysicalAddress,
IPAddress targetIpAddress, PhysicalAddress targetPhysicalAddress)
{
var arpPacket = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse("000000000000"), targetIpAddress, senderPhysicalAddress, senderIpAddress);
return(new EthernetPacket(_device.MacAddress, targetPhysicalAddress, EthernetPacketType.Arp)
{
PayloadPacket = arpPacket
});
}
private ARPPacket BuildRequest(string destIP, string localMAC, string localIP)
{
ARPPacket arp = BuildARP(localMAC, localIP);
arp.ARPOperation = ARPFields_Fields.ARP_OP_REQ_CODE;
arp.ARPTargetHwAddress = "00:00:00:00:00:00";
arp.ARPTargetProtoAddress = destIP;
arp.DestinationHwAddress = "ff:ff:ff:ff:ff:ff";
return(arp);
}
public EthernetPacket CreateRequestArpPacket(ICaptureDevice dev, PhysicalAddress srcMac, IPAddress srcIp, IPAddress targetIp, PhysicalAddress trgtMac)
{
var ethernetPacket = new EthernetPacket(srcMac, trgtMac, EthernetPacketType.Arp);
var arpPacket = new ARPPacket(PacketDotNet.ARPOperation.Request, trgtMac, targetIp, srcMac, srcIp);
ethernetPacket.PayloadPacket = arpPacket;
return(ethernetPacket);
}
public void arp_request(Rozhranie rozhranie, IPAddress hladana_ip)
{
if (rozhranie.adapter.MacAddress != null)
{
EthernetPacket ethernet_packet = new EthernetPacket(rozhranie.adapter.MacAddress, PhysicalAddress.Parse("FF-FF-FF-FF-FF-FF"), EthernetPacketType.Arp);
arp_packet = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse("00-00-00-00-00-00"), hladana_ip, rozhranie.adapter.MacAddress, IPAddress.Parse(rozhranie.ip_adresa));
ethernet_packet.PayloadPacket = arp_packet;
rozhranie.adapter.SendPacket(ethernet_packet);
}
}
public PacketDetials(Packet packet)
{
this.packet = packet;
ethernetPacket = EthernetPacket.GetEncapsulated(packet);
if (ethernetPacket != null)
{
typeName = "Ethernet";
}
ipPacket = IpPacket.GetEncapsulated(packet);
if (ipPacket != null)
{
typeName = "Ip";
}
arpPacket = ARPPacket.GetEncapsulated(packet);
if (arpPacket != null)
{
typeName = "ARP";
}
icmpv4Packet = ICMPv4Packet.GetEncapsulated(packet);
if (icmpv4Packet != null)
{
typeName = "ICMPv4";
}
icmpv6Packet = ICMPv6Packet.GetEncapsulated(packet);
if (icmpv6Packet != null)
{
typeName = "ICMPv6";
}
igmpv2Packet = IGMPv2Packet.GetEncapsulated(packet);
if (igmpv2Packet != null)
{
typeName = "IGMPv2";
}
pppoePacket = PPPoEPacket.GetEncapsulated(packet);
if (pppoePacket != null)
{
typeName = "PPPoE";
}
pppPacket = PPPPacket.GetEncapsulated(packet);
if (pppPacket != null)
{
typeName = "PPP";
}
tcpPacket = TcpPacket.GetEncapsulated(packet);
if (tcpPacket != null)
{
typeName = "TCP";
}
udpPacket = UdpPacket.GetEncapsulated(packet);
if (udpPacket != null)
{
typeName = "UDP";
}
}
public void BlockOrRedirect()
{
ICaptureDevice capturedevice = (from devicex in CaptureDeviceList.Instance where ((SharpPcap.WinPcap.WinPcapDevice)devicex).Interface.FriendlyName == NetStalker.Properties.Settings.Default.friendlyname select devicex).ToList()[0];
capturedevice.Open();
#region Spoof
ARPPacket ArpPacketForVicSpoof = new ARPPacket(ARPOperation.Request, MAC, IP, capturedevice.MacAddress, GatewayIP);
ARPPacket ArpPacketForGatewaySpoof = new ARPPacket(ARPOperation.Request, GatewayMAC, GatewayIP, capturedevice.MacAddress, IP);
EthernetPacket EtherPacketForVicSpoof = new EthernetPacket(capturedevice.MacAddress, MAC, EthernetPacketType.Arp);
EthernetPacket EtherPacketForGatewaySpoof = new EthernetPacket(capturedevice.MacAddress, GatewayMAC, EthernetPacketType.Arp);
EtherPacketForGatewaySpoof.PayloadPacket = ArpPacketForGatewaySpoof;
EtherPacketForVicSpoof.PayloadPacket = ArpPacketForVicSpoof;
#endregion
#region Protection
ARPPacket ArpPacketForVicProtection = new ARPPacket(ARPOperation.Request, capturedevice.MacAddress, LocalIP, MAC, IP);
ARPPacket ArpPacketForGatewayProtection = new ARPPacket(ARPOperation.Request, capturedevice.MacAddress, LocalIP, GatewayMAC, GatewayIP);
EthernetPacket EtherPacketForVicProtection = new EthernetPacket(MAC, capturedevice.MacAddress, EthernetPacketType.Arp);
EthernetPacket EtherPacketForGatewayProtection = new EthernetPacket(GatewayMAC, capturedevice.MacAddress, EthernetPacketType.Arp);
EtherPacketForGatewayProtection.PayloadPacket = ArpPacketForGatewayProtection;
EtherPacketForVicProtection.PayloadPacket = ArpPacketForVicProtection;
#endregion
new Thread(() =>
{
try
{
while (Blocked)
{
capturedevice.SendPacket(EtherPacketForVicSpoof);
if (Redirected)
{
capturedevice.SendPacket(EtherPacketForGatewaySpoof);
}
if (SpoofProtection)
{
capturedevice.SendPacket(EtherPacketForGatewayProtection);
capturedevice.SendPacket(EtherPacketForVicProtection);
}
Thread.Sleep(500);
}
}
catch (PcapException)
{
}
}).Start();
}
public void arp_reply(EthernetPacket eth, Rozhranie rozhranie, IPAddress odosielatel_address, IPAddress ciel_adres)
{
if (rozhranie.adapter.MacAddress != null)
{
EthernetPacket ethernet_packet = new EthernetPacket(rozhranie.adapter.MacAddress, eth.SourceHwAddress, EthernetPacketType.Arp);
arp_packet = new ARPPacket(ARPOperation.Response, eth.SourceHwAddress, odosielatel_address, rozhranie.adapter.MacAddress, ciel_adres);
ethernet_packet.PayloadPacket = arp_packet;
rozhranie.adapter.SendPacket(ethernet_packet);
}
}
/// <summary>
/// Actively monitor ARP packets for signs of new clients after GetAllClients active scan is done
/// </summary>
public static void BackgroundScanStart(IView view, string interfacefriendlyname)
{
try
{
IPAddress myipaddress = ((SharpPcap.WinPcap.WinPcapDevice)capturedevice).Addresses[1].Addr.ipAddress; //possible critical point : Addresses[1] in hardcoding the index for obtaining ipv4 address
#region Sending ARP requests to probe for all possible IP addresses on LAN
new Thread(() =>
{
try
{
while (capturedevice != null)
{
for (int ipindex = 1; ipindex <= 255; ipindex++)
{
ARPPacket arprequestpacket = new ARPPacket(ARPOperation.Request, PhysicalAddress.Parse("00-00-00-00-00-00"), IPAddress.Parse(GetRootIp(myipaddress) + ipindex), capturedevice.MacAddress, myipaddress);
EthernetPacket ethernetpacket = new EthernetPacket(capturedevice.MacAddress, PhysicalAddress.Parse("FF-FF-FF-FF-FF-FF"), EthernetPacketType.Arp);
ethernetpacket.PayloadPacket = arprequestpacket;
capturedevice.SendPacket(ethernetpacket);
}
}
}
catch (PcapException ex)
{
DebugOutputClass.Print(view, "PcapException @ GetClientList.BackgroundScanStart() probably due to capturedevice being closed by refreshing or by exiting application [" + ex.Message + "]");
}
catch (Exception ex)
{
DebugOutputClass.Print(view, "Exception at GetClientList.BackgroundScanStart() inside new Thread(()=>{}) while sending packets [" + ex.Message + "]");
}
}).Start();
#endregion
#region Assign OnPacketArrival event handler and start capturing
capturedevice.OnPacketArrival += (object sender, CaptureEventArgs e) =>
{
Packet packet = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
ARPPacket arppacket = (ARPPacket)packet.Extract(typeof(ARPPacket));
if (!clientlist.ContainsKey(arppacket.SenderProtocolAddress) && arppacket.SenderProtocolAddress.ToString() != "0.0.0.0" && areCompatibleIPs(arppacket.SenderProtocolAddress, myipaddress))
{
DebugOutputClass.Print(view, "Added " + arppacket.SenderProtocolAddress.ToString() + " @ " + GetMACString(arppacket.SenderHardwareAddress) + " from background scan!");
clientlist.Add(arppacket.SenderProtocolAddress, arppacket.SenderHardwareAddress);
view.ListView1.Invoke(new Action(() => view.ListView1.Items.Add(new ListViewItem(new string[] { (clientlist.Count).ToString(), arppacket.SenderProtocolAddress.ToString(), GetMACString(arppacket.SenderHardwareAddress), "On", ApplicationSettingsClass.GetSavedClientNameFromMAC(GetMACString(arppacket.SenderHardwareAddress)) }))));
view.MainForm.Invoke(new Action(() => view.ToolStripStatusScan.Text = clientlist.Count + " device(s) found"));
}
};
capturedevice.StartCapture();
#endregion
}
catch (Exception ex)
{
DebugOutputClass.Print(view, "Exception at GetClientList.BackgroundScanStart() [" + ex.Message + "]");
}
}
private void Run()
{
var l_Mac = NetworkUtils.GetMacFromIp(IPAddress.Parse(m_Ip));
if (l_Mac != null)
{
m_Mac = l_Mac.ToString();
var l_ArpPacket = new ARPPacket(ARPOperation.Response, l_Mac, IPAddress.Parse(m_Ip), NetworkUtils.GetLocalMac(), NetworkUtils.GetGatewayAddr());
m_ArpPacket = new EthernetPacket(NetworkUtils.GetLocalMac(), l_Mac, EthernetPacketType.Arp);
m_ArpPacket.PayloadPacket = l_ArpPacket;
}
}
/// <summary>
/// 以太网
/// </summary>
/// <param name="packet"></param>
private void Ethernet(Packet packet)
{
EthernetPacket e = EthernetPacket.GetEncapsulated(packet);
if (EthernetNode == null)
{
EthernetNode = new TreeNode("EthernetII");
EthernetNode.Name = "Ethernet";
EthernetNode.ImageIndex = 0;
EthernetNode.SelectedImageIndex = 0;
}
EthernetNode.Nodes.Clear();
EthernetNode.Nodes.Add("Destination: " + Format.MacFormat(e.DestinationHwAddress.ToString()));
EthernetNode.Nodes.Add("Source: " + Format.MacFormat(e.SourceHwAddress.ToString()));
EthernetNode.Nodes.Add("Type: " + e.Type.ToString() + " [0x" + e.Type.ToString("X") + "]");
Tree.Nodes.Add(EthernetNode);
switch (e.Type)
{
case EthernetPacketType.Arp: //ARP协议
ARPPacket arp = ARPPacket.GetEncapsulated(packet);
Arp(arp);
break;
case EthernetPacketType.IpV4: //IP协议
case EthernetPacketType.IpV6:
IpPacket ip = IpPacket.GetEncapsulated(packet);
IP(ip);
break;
case EthernetPacketType.WakeOnLan: //网络唤醒协议
WakeOnLanPacket wake = WakeOnLanPacket.GetEncapsulated(packet);
Wake_on_Lan(wake);
break;
case EthernetPacketType.LLDP: //链路层发现协议
LLDPPacket ll = LLDPPacket.GetEncapsulated(packet);
LLDPProtocol(ll);
break;
case EthernetPacketType.PointToPointProtocolOverEthernetDiscoveryStage:
case EthernetPacketType.PPPoE:
PPPoEPacket pppoe = PPPoEPacket.GetEncapsulated(packet);
PPPOE(pppoe);
break;
case EthernetPacketType.None: //无可用协议
default:
PayLoadData = e.PayloadData;
break;
}
}
private ARPPacket BuildRequest(System.Net.IPAddress destIP,
PhysicalAddress localMAC,
System.Net.IPAddress localIP)
{
ARPPacket arp = BuildARP(localMAC, localIP);
arp.ARPOperation = ARPFields_Fields.ARP_OP_REQ_CODE;
arp.ARPTargetHwAddress = PhysicalAddress.Parse("00-00-00-00-00-00");
arp.ARPTargetProtoAddress = destIP;
arp.DestinationHwAddress = PhysicalAddress.Parse("FF-FF-FF-FF-FF-FF");
return(arp);
}
