protected IEnumerable <Frame> GetFramesFromPcapAndDefragment(String pcapFileName)
{
var ipv4DefragmentationEngine =
new Ipv4DefragmentationEngine(this._services.GetService <ILoggerFactory>().CreateLogger <Ipv4DefragmentationEngine>());
var frames = new List <Frame>();
foreach (var(packet, timestampTicks) in this.GetPacketsFromPcap(pcapFileName))
{
Frame frame;
if (!(packet.PayloadPacket is IPPacket ipPacket))
{
continue;
}
if (ipPacket is IPv4Packet ipv4Packet && Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
var(isDefragmentationSuccessful, defragmentedIpv4Packet, fragments) =
ipv4DefragmentationEngine.TryDefragmentFragments(FrameFactory.CreateFromIpPacket(ipv4Packet, timestampTicks));
if (!isDefragmentationSuccessful)
{
continue;
}
frame = FrameFactory.CreateFromDefragmentedIpPacket(defragmentedIpv4Packet, fragments);
}
protected IEnumerable <Frame> GetFramesFromPcapAndDefragment(Uri pcapUri)
{
var ipv4DefragmentationEngine =
new Ipv4DefragmentationEngine(this._services.GetService <ILoggerFactory>().CreateLogger <Ipv4DefragmentationEngine>());
var frames = new List <Frame>();
var pcapLoader = this._services.GetService <IPcapLoader>();
using (pcapLoader)
{
RawCapture rawCapture;
pcapLoader.Open(pcapUri);
while ((rawCapture = pcapLoader.GetNextPacket()) != null)
{
Frame frame;
var parsedPacket = Packet.ParsePacket(pcapLoader.LinkType, rawCapture.Data);
if (!(parsedPacket.PayloadPacket is IPPacket ipPacket))
{
continue;
;
}
if (ipPacket is IPv4Packet ipv4Packet && Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
var(isDefragmentationSuccessful, firstTimeStamp, defragmentedIpv4Packet) =
ipv4DefragmentationEngine.TryDefragmentFragments(
FrameFactory.CreateFromIpPacket(ipv4Packet, rawCapture.Timeval.Date.Ticks));
if (!isDefragmentationSuccessful)
{
continue;
}
frame = FrameFactory.CreateFromIpPacket(defragmentedIpv4Packet, firstTimeStamp);
}
protected IMaybeMultipleValues <RawPacket> ParsePacket(RawCapture rawCapture)
{
if (rawCapture == null)
{
return(new ProcessRawPacketRequestError("Missing packet payload"));
}
// return new RawPacket(rawCapture) {EntityId = 0};
Packet parsedPacket;
try
{
parsedPacket = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
}
catch (ArgumentOutOfRangeException ex)
{
return(new ProcessRawPacketRequestError($"Parsing error {ex}"));
}
// Ignore non-IP traffic (STP, ... )
if (!(parsedPacket?.PayloadPacket is IPPacket ipPacket))
{
return(new ProcessRawPacketRequestError("Non-IP packet"));
}
// Attempt to defragment
if (ipPacket is IPv4Packet ipv4Packet && Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
var(isDefragmentationSuccessful, firstTimestamp, defragmentedIpv4Packet) =
this.IPIpv4DefragmentationEngine.TryDefragmentFragments(
FrameFactory.CreateFromIpPacket(ipv4Packet, rawCapture.Timeval.Date.Ticks));
if (!isDefragmentationSuccessful)
{
return(ProcessRawPacketFragmentsRequest.EmptyInstance);
}
var defragmentedL3L4Key = new L3L4ConversationKey(defragmentedIpv4Packet);
return(new RawPacket(firstTimestamp, LinkLayers.Raw, defragmentedIpv4Packet.Bytes, defragmentedL3L4Key,
this.MaxNumberOfShards));
}
// Ignore unsupported transport protocols
var transportPacket = ipPacket.PayloadPacket;
if (!(transportPacket is TcpPacket || transportPacket is UdpPacket))
{
return(new ProcessRawPacketRequestError("Unsupported transport protocol"));
}
var l3L4Key = new L3L4ConversationKey(ipPacket);
return(new RawPacket(rawCapture, l3L4Key, this.MaxNumberOfShards));
}
private static Boolean TryDissectFragmentedIpPacket(Frame frame, IPPacket ipPacket)
{
if (ipPacket is IPv4Packet ipv4Packet && Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
frame.IsIpv4Fragmented = true;
frame.Key = new IPFragmentKey(ipv4Packet);
frame.Offset = ipv4Packet.FragmentOffset * 8;
frame.MoreFragments = (ipv4Packet.FragmentFlags & 0b001) != 0;
frame.L7Payload = ipv4Packet.PayloadData ?? ipv4Packet.PayloadPacket.Bytes;
frame.HeaderLen = ipv4Packet.HeaderLength;
return(true);
}
return(false);
}
private static Boolean TryDissectFragmentedIpPacket(Frame frame, IPPacket ipPacket)
{
if (!(ipPacket is IPv4Packet ipv4Packet) || !Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
return(false);
}
frame.IsIpv4Fragmented = true;
frame.Ipv4FragmentKey = new IPFragmentKey(ipv4Packet);
frame.Ipv4FragmentOffset = ipv4Packet.FragmentOffset * 8;
frame.MoreIpv4Fragments = (ipv4Packet.FragmentFlags & 0b001) != 0;
// frame.SetupL7PayloadDataSegment(ipPacket.PayloadDataHighPerformance.Offset);
SetupFrameL7PayloadDataSegmentFromPacketPayload(frame, ipPacket.HeaderDataHighPerformance);
return(true);
}
private IEnumerable <Frame> GetFramesFromPcap(Uri pcapUri)
{
var ipv4DefragmentationEngine = new Ipv4DefragmentationEngine(this._loggerFactory.CreateLogger <Ipv4DefragmentationEngine>());
foreach (var(packet, timestampTicks) in this.GetPacketsFromPcap(pcapUri))
{
Frame frame;
if (!(packet.PayloadPacket is IPPacket ipPacket))
{
continue;
}
if (ipPacket is IPv4Packet ipv4Packet && Ipv4Helpers.Ipv4PacketIsFragmented(ipv4Packet))
{
var(isDefragmentationSuccessful, defragmentedIpv4Packet, fragments) =
ipv4DefragmentationEngine.TryDefragmentFragments(FrameFactory.CreateFromIpPacket(ipv4Packet, timestampTicks));
if (!isDefragmentationSuccessful)
{
continue;
}
frame = FrameFactory.CreateFromDefragmentedIpPacket(defragmentedIpv4Packet, fragments);
}
