public void ReadingPacketsFromFile()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_per_packet_information.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
Assert.IsNotNull(p);
Assert.AreEqual(0, p.Version);
Assert.AreEqual(32, p.Length);
Assert.AreEqual(1, p.Count);
PpiCommon commonField = p.FindFirstByType(PpiFieldType.PpiCommon) as PpiCommon;
Assert.AreEqual(PpiFieldType.PpiCommon, commonField.FieldType);
Assert.AreEqual(0, commonField.TSFTimer);
Assert.IsTrue((commonField.Flags & PpiCommon.CommonFlags.FcsIncludedInFrame) == PpiCommon.CommonFlags.FcsIncludedInFrame);
Assert.AreEqual(2, commonField.Rate);
Assert.AreEqual(2437, commonField.ChannelFrequency);
Assert.AreEqual(0x00A0, (Int32)commonField.ChannelFlags);
Assert.AreEqual(0, commonField.FhssHopset);
Assert.AreEqual(0, commonField.FhssPattern);
Assert.AreEqual(-84, commonField.AntennaSignalPower);
Assert.AreEqual(-100, commonField.AntennaSignalNoise);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.AreEqual(FrameControlField.FrameSubTypes.ControlCTS, macFrame.FrameControl.SubType);
Assert.IsTrue(macFrame.AppendFcs);
}
public void RemoveField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_multiplefields.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
var expectedLength = p.Length - p[1].Length - PpiHeaderFields.FieldHeaderLength;
p.Remove(p[1]);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, p.Bytes) as PpiPacket;
Assert.AreEqual(expectedLength, recreatedPacket.Length);
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiCommon));
Assert.IsFalse(recreatedPacket.Contains(PpiFieldType.PpiMacPhy));
MacFrame macFrame = recreatedPacket.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.FCSValid);
}
public void AddUnknownField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_multiplefields.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
PpiUnknown unknownField = new PpiUnknown(99, new Byte[] { 0xAA, 0xBB, 0xCC, 0xDD });
p.Add(unknownField);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, p.Bytes) as PpiPacket;
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiCommon));
Assert.IsTrue(recreatedPacket.Contains(PpiFieldType.PpiMacPhy));
Assert.IsTrue(recreatedPacket.Contains((PpiFieldType)99));
PpiUnknown recreatedUnknownField = recreatedPacket.FindFirstByType((PpiFieldType)99) as PpiUnknown;
Assert.AreEqual(new Byte[] { 0xAA, 0xBB, 0xCC, 0xDD }, recreatedUnknownField.UnknownBytes);
MacFrame macFrame = recreatedPacket.PayloadPacket as MacFrame;
Assert.IsNotNull(macFrame);
Assert.IsTrue(macFrame.FCSValid);
}
public void ConstructPacketWithNoFields()
{
var packet = new PpiPacket();
var recreatedPacket = Packet.ParsePacket(LinkLayers.Ppi, packet.Bytes) as PpiPacket;
Assert.AreEqual(0, recreatedPacket.Version);
Assert.IsFalse((recreatedPacket.Flags & PpiPacket.HeaderFlags.Alignment32Bit) == PpiPacket.HeaderFlags.Alignment32Bit);
}
public void ConstructPacketWithMultipleAlignedFields()
{
PpiPacket packet = new PpiPacket();
packet.Flags |= PpiPacket.HeaderFlags.Alignment32Bit;
PpiCommon commonField = new PpiCommon();
commonField.ChannelFrequency = 2142;
commonField.AntennaSignalPower = 50;
commonField.AntennaSignalNoise = 25;
packet.Add(commonField);
Assert.AreEqual(32, packet.Length);
PpiProcessInfo processInfoField = new PpiProcessInfo();
processInfoField.UserId = 0x1111;
processInfoField.UserName = "******";
processInfoField.GroupId = 0x2222;
processInfoField.GroupName = "Test Group";
packet.Add(processInfoField);
Assert.AreEqual(84, packet.Length);
PpiAggregation aggregationField = new PpiAggregation(0x3333);
packet.Add(aggregationField);
Assert.AreEqual(92, packet.Length);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, packet.Bytes) as PpiPacket;
PpiCommon recreatedCommonField = recreatedPacket[0] as PpiCommon;
Assert.IsNotNull(recreatedCommonField);
Assert.AreEqual(2142, recreatedCommonField.ChannelFrequency);
Assert.AreEqual(50, recreatedCommonField.AntennaSignalPower);
Assert.AreEqual(25, recreatedCommonField.AntennaSignalNoise);
PpiProcessInfo recreatedProcessField = recreatedPacket[1] as PpiProcessInfo;
Assert.IsNotNull(recreatedProcessField);
Assert.AreEqual(0x1111, recreatedProcessField.UserId);
Assert.AreEqual("Hester the tester", recreatedProcessField.UserName);
Assert.AreEqual(0x2222, recreatedProcessField.GroupId);
Assert.AreEqual("Test Group", recreatedProcessField.GroupName);
PpiAggregation recreatedAggregationField = recreatedPacket[2] as PpiAggregation;
Assert.IsNotNull(recreatedAggregationField);
Assert.AreEqual(0x3333, recreatedAggregationField.InterfaceId);
}
public void ContainsField()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_multiplefields.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
Assert.IsTrue(p.Contains(PpiFieldType.PpiCommon));
Assert.IsTrue(p.Contains(PpiFieldType.PpiMacPhy));
Assert.IsFalse(p.Contains(PpiFieldType.PpiProcessInfo));
}
public void ConstructPacketWithMultipleFields()
{
var packet = new PpiPacket();
var commonField = new PpiCommon {
ChannelFrequency = 2142, AntennaSignalPower = 50, AntennaSignalNoise = 25
};
packet.Add(commonField);
Assert.AreEqual(32, packet.Length);
var processInfoField = new PpiProcessInfo {
UserId = 0x1111, UserName = "******", GroupId = 0x2222, GroupName = "Test Group"
};
packet.Add(processInfoField);
Assert.AreEqual(82, packet.Length);
var aggregationField = new PpiAggregation(0x3333);
packet.Add(aggregationField);
Assert.AreEqual(90, packet.Length);
var recreatedPacket = Packet.ParsePacket(LinkLayers.Ppi, packet.Bytes) as PpiPacket;
var recreatedCommonField = recreatedPacket[0] as PpiCommon;
Assert.IsNotNull(recreatedCommonField);
Assert.AreEqual(2142, recreatedCommonField.ChannelFrequency);
Assert.AreEqual(50, recreatedCommonField.AntennaSignalPower);
Assert.AreEqual(25, recreatedCommonField.AntennaSignalNoise);
var recreatedProcessField = recreatedPacket[1] as PpiProcessInfo;
Assert.IsNotNull(recreatedProcessField);
Assert.AreEqual(0x1111, recreatedProcessField.UserId);
Assert.AreEqual("Hester the tester", recreatedProcessField.UserName);
Assert.AreEqual(0x2222, recreatedProcessField.GroupId);
Assert.AreEqual("Test Group", recreatedProcessField.GroupName);
var recreatedAggregationField = recreatedPacket[2] as PpiAggregation;
Assert.IsNotNull(recreatedAggregationField);
Assert.AreEqual(0x3333, recreatedAggregationField.InterfaceId);
}
public void ReadPacketWithInvalidFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_fcs_present_and_invalid.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
//The packet is corrupted in such a way that the type field has been changed
//to a reserved/unused type. Therefore we don't expect there to be a packet
Assert.IsNull(p.PayloadPacket);
Assert.IsNotNull(p.PayloadData);
}
public void ReadPacketWithValidFcs()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_ppi_fcs_present_and_valid.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
PpiPacket p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data) as PpiPacket;
Assert.IsNotNull(p.PayloadPacket);
MacFrame macFrame = p.PayloadPacket as MacFrame;
Assert.IsTrue(macFrame.FCSValid);
Assert.IsTrue(macFrame.AppendFcs);
}
/// <summary>
/// Parse bytes into a packet
/// </summary>
/// <param name="linkLayer">
/// A <see cref="LinkLayers" />
/// </param>
/// <param name="packetData">
/// A <see cref="System.Byte" />
/// </param>
/// <returns>
/// A <see cref="Packet" />
/// </returns>
public static Packet ParsePacket(LinkLayers linkLayer, byte[] packetData)
{
Packet p;
var bas = new ByteArraySegment(packetData);
Log.DebugFormat("LinkLayer {0}", linkLayer);
switch (linkLayer)
{
case LinkLayers.Ethernet:
p = new EthernetPacket(bas);
break;
case LinkLayers.LinuxSLL:
p = new LinuxSLLPacket(bas);
break;
case LinkLayers.Ppp:
p = new PPPPacket(bas);
break;
case LinkLayers.Ieee80211:
p = MacFrame.ParsePacket(bas);
break;
case LinkLayers.Ieee80211_Radio:
p = new RadioPacket(bas);
break;
case LinkLayers.PerPacketInformation:
p = new PpiPacket(bas);
break;
//http://sourceforge.net/p/packetnet/patches/1/
case LinkLayers.Raw:
var ipVer = (packetData[0] & 0xf0) >> 4;
p = (ipVer == 4)? new IPv4Packet(bas) : new IPv6Packet(bas) as Packet;
break;
default:
throw new NotImplementedException("LinkLayer of " + linkLayer + " is not implemented");
}
return(p);
}
public void ConstructPacketWithMultipleAlignedFields()
{
PpiPacket packet = new PpiPacket();
packet.Flags |= PpiPacket.HeaderFlags.Alignment32Bit;
PpiCommon commonField = new PpiCommon();
commonField.ChannelFrequency = 2142;
commonField.AntennaSignalPower = 50;
commonField.AntennaSignalNoise = 25;
packet.Add(commonField);
Assert.AreEqual(32, packet.Length);
PpiProcessInfo processInfoField = new PpiProcessInfo();
processInfoField.UserId = 0x1111;
processInfoField.UserName = "******";
processInfoField.GroupId = 0x2222;
processInfoField.GroupName = "Test Group";
packet.Add(processInfoField);
Assert.AreEqual(84, packet.Length);
PpiAggregation aggregationField = new PpiAggregation(0x3333);
packet.Add(aggregationField);
Assert.AreEqual(92, packet.Length);
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, packet.Bytes) as PpiPacket;
PpiCommon recreatedCommonField = recreatedPacket[0] as PpiCommon;
Assert.IsNotNull(recreatedCommonField);
Assert.AreEqual(2142, recreatedCommonField.ChannelFrequency);
Assert.AreEqual(50, recreatedCommonField.AntennaSignalPower);
Assert.AreEqual(25, recreatedCommonField.AntennaSignalNoise);
PpiProcessInfo recreatedProcessField = recreatedPacket[1] as PpiProcessInfo;
Assert.IsNotNull(recreatedProcessField);
Assert.AreEqual(0x1111, recreatedProcessField.UserId);
Assert.AreEqual("Hester the tester", recreatedProcessField.UserName);
Assert.AreEqual(0x2222, recreatedProcessField.GroupId);
Assert.AreEqual("Test Group", recreatedProcessField.GroupName);
PpiAggregation recreatedAggregationField = recreatedPacket[2] as PpiAggregation;
Assert.IsNotNull(recreatedAggregationField);
Assert.AreEqual(0x3333, recreatedAggregationField.InterfaceId);
}
public void ConstructPacketWithNoFields()
{
PpiPacket packet = new PpiPacket();
PpiPacket recreatedPacket = Packet.ParsePacket(LinkLayers.PerPacketInformation, packet.Bytes) as PpiPacket;
Assert.AreEqual(0, recreatedPacket.Version);
Assert.IsFalse((recreatedPacket.Flags & PpiPacket.HeaderFlags.Alignment32Bit) == PpiPacket.HeaderFlags.Alignment32Bit);
}
