public void ProcessPcap()
{
sharpPcapDict = new Dictionary <Connection, TcpRecon>();
PcapDevice device;
try
{
device = SharpPcap.GetPcapOfflineDevice(capFile);
device.PcapOpen();
}
catch (Exception ex)
{
ErrorMessage = "Error Loading pcap with SharpPcap: " + ex.Message;
return;
}
device.PcapOnPacketArrival += new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
device.PcapCapture(SharpPcap.INFINITE); //parse entire pcap until EOF
device.PcapClose();
foreach (TcpRecon tr in sharpPcapDict.Values)
{
tr.isComplete = true;
if (tr.LastSavedOffset != tr.CurrentOffset)
{
AddNewNode(tr);
}
tr.Close();
}
sharpPcapDict.Clear();
owner.Invoke(Complete, ips);
return;
}
public void ReadPcapFile(string capFile)
{
PcapDevice device;
try
{
//Get an offline file pcap device
device = SharpPcap.GetPcapOfflineDevice(capFile);
//Open the device for capturing
device.PcapOpen();
}
catch (Exception)
{
return;
}
//Register our handler function to the 'packet arrival' event
device.PcapOnPacketArrival +=
new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
//device.PcapSetFilter(this.tcpDumpFilter);
//Start capture 'INFINTE' number of packets
//This method will return when EOF reached.
device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
device.PcapClose();
}
/// <summary>
/// Reconstruct a Pcap file using TcpRecon class
/// </summary>
/// <param name="capFile"></param>
public static void ReconSingleFileSharpPcap(string capFile)
{
PcapDevice device;
//FileInfo fi = new FileInfo(capFile);
var fi = zFile.CreateFileInfo(capFile);
path = fi.DirectoryName + "\\";
try
{
//Get an offline file pcap device
device = SharpPcap.GetPcapOfflineDevice(capFile);
//Open the device for capturing
device.PcapOpen();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return;
}
//Register our handler function to the 'packet arrival' event
device.PcapOnPacketArrival +=
new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
// FOR THIS LINE TO WORK YOU NEED TO CHANGE THE
// SHARPPCAP LIBRARY MANUALLY AND REMOVE PcapSetFilter method
// FROM PcapOfflineDevice
//
// add a filter so we get only tcp packets
// device.PcapSetFilter("tcp");
//Start capture 'INFINTE' number of packets
//This method will return when EOF reached.
device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
device.PcapClose();
// Clean up
foreach (TcpRecon tr in sharpPcapDict.Values)
{
tr.Close();
}
sharpPcapDict.Clear();
}
public static void Main(string[] args)
{
string ver = Tamir.IPLib.Version.GetVersionString();
/* Print SharpPcap version */
Console.WriteLine("SharpPcap {0}, Example8.ReadFile.cs", ver);
Console.WriteLine();
Console.WriteLine();
Console.Write("-- Please enter an input capture file name: ");
string capFile = Console.ReadLine();
PcapDevice device;
try
{
//Get an offline file pcap device
device = SharpPcap.GetPcapOfflineDevice(capFile);
//Open the device for capturing
device.PcapOpen();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return;
}
//Register our handler function to the 'packet arrival' event
device.PcapOnPacketArrival +=
new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
Console.WriteLine();
Console.WriteLine
("-- Capturing from '{0}', hit 'Ctrl-C' to exit...",
capFile);
//Start capture 'INFINTE' number of packets
//This method will return when EOF reached.
device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
device.PcapClose();
Console.WriteLine("-- End of file reached.");
Console.Write("Hit 'Enter' to exit...");
Console.ReadLine();
}
private void startCapture()
{
while (IsCapturing)
{
if (_device == null)
{
if (_offlineDevs.Count > 0)
{
DeviceName = _offlineDevs[0];
_device = SharpPcap.GetPcapOfflineDevice(DeviceName);
_offlineDevs.RemoveAt(0);
}
else
{
StopCapture();
}
}
else
{
DeviceName = ((NetworkDevice)_device).Description;
}
try
{
_device.PcapOpen();
}
catch (Exception ee)
{
ErrorMsg = ee.Message;
StopCapture();
return;
}
//Register our handler function to the
//'packet arrival' event
_device.PcapOnPacketArrival += new SharpPcap.PacketArrivalEvent(pcapOnPacketArrival);
//Start the capturing process
_device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
_device.PcapClose();
_device = null;
}
}
private static void readFile()
{
string capFile
= @"C:\test2.pcap";//Console.ReadLine();
PcapDevice device;
try
{
//Get an offline file pcap device
device = SharpPcap.GetPcapOfflineDevice(capFile);
//Open the device for capturing
device.PcapOpen();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return;
}
//Register our handler function to the 'packet arrival' event
device.PcapOnPacketArrival +=
new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
Console.WriteLine();
Console.WriteLine
("-- Capturing from '{0}', hit 'Ctrl-C' to exit...",
capFile);
//Start capture 'INFINTE' number of packets
//This method will return when EOF reached.
device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
device.PcapClose();
Console.WriteLine("-- End of file reached.");
Console.In.ReadLine();
}
static void Main(string[] args)
{
string ver = Tamir.IPLib.Version.GetVersionString();
/* Print SharpPcap version */
Console.WriteLine("SharpPcap {0}, Example12.PacketManipulation.cs", ver);
Console.WriteLine();
/* Retrieve the device list */
PcapDeviceList devices = SharpPcap.GetAllDevices();
/*If no device exists, print error */
if (devices.Count < 1)
{
Console.WriteLine("No device found on this machine");
return;
}
Console.WriteLine("The following devices are available on this machine:");
Console.WriteLine("----------------------------------------------------");
Console.WriteLine();
int i = 0;
/* Scan the list printing every entry */
foreach (PcapDevice dev in devices)
{
/* Description */
Console.WriteLine("{0}) {1}", i, dev.PcapDescription);
i++;
}
Console.WriteLine("{0}) {1}", i, "Read packets from offline pcap file");
Console.WriteLine();
Console.Write("-- Please choose a device to capture: ");
int choice = int.Parse(Console.ReadLine());
PcapDevice device = null;
if (choice == i)
{
Console.Write("-- Please enter an input capture file name: ");
string capFile = Console.ReadLine();
device = SharpPcap.GetPcapOfflineDevice(capFile);
}
else
{
device = devices[choice];
}
//Register our handler function to the 'packet arrival' event
device.PcapOnPacketArrival +=
new Tamir.IPLib.SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
//Open the device for capturing
//true -- means promiscuous mode
//1000 -- means a read wait of 1000ms
device.PcapOpen(true, 1000);
Console.WriteLine();
Console.WriteLine
("-- Listenning on {0}, hit 'Ctrl-C' to exit...",
device.PcapDescription);
//Start capture 'INFINTE' number of packets
device.PcapCapture(SharpPcap.INFINITE);
//Close the pcap device
//(Note: this line will never be called since
// we're capturing infinite number of packets
device.PcapClose();
}
public static void Main(string[] args)
{
string ver = Tamir.IPLib.Version.GetVersionString();
/* Print SharpPcap version */
Console.WriteLine("SharpPcap {0}, Example10.SendQueues.cs", ver);
Console.WriteLine();
Console.Write("-- Please enter an input capture file name: ");
string capFile = Console.ReadLine();
PcapDevice device;
try
{
//Get an offline file pcap device
device = SharpPcap.GetPcapOfflineDevice(capFile);
//Open the device for capturing
device.PcapOpen();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return;
}
Console.Write("Queueing packets...");
//Allocate a new send queue
PcapSendQueue squeue = new PcapSendQueue
((int)((PcapOfflineDevice)device).PcapFileSize);
Packet packet;
try
{
//Go through all packets in the file and add to the queue
while ((packet = device.PcapGetNextPacket()) != null)
{
if (!squeue.Add(packet))
{
Console.WriteLine("Warning: packet buffer too small, " +
"not all the packets will be sent.");
break;
}
}
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return;
}
Console.WriteLine("OK");
Console.WriteLine();
Console.WriteLine("The following devices are available on this machine:");
Console.WriteLine("----------------------------------------------------");
Console.WriteLine();
int i = 0;
PcapDeviceList devices = SharpPcap.GetAllDevices();
/* Scan the list printing every entry */
foreach (PcapDevice dev in devices)
{
/* Description */
Console.WriteLine("{0}) {1}", i, dev.PcapDescription);
i++;
}
Console.WriteLine();
Console.Write("-- Please choose a device to transmit on: ");
i = int.Parse(Console.ReadLine());
devices[i].PcapOpen();
string resp;
if (devices[i].PcapDataLink != device.PcapDataLink)
{
Console.Write("Warning: the datalink of the capture" +
" differs from the one of the selected interface, continue? [YES|no]");
resp = Console.ReadLine().ToLower();
if ((resp != "") && (!resp.StartsWith("y")))
{
Console.WriteLine("Cancelled by user!");
devices[i].PcapClose();
return;
}
}
device.PcapClose();
device = devices[i];
Console.Write("This will transmit all queued packets through" +
" this device, continue? [YES|no]");
resp = Console.ReadLine().ToLower();
if ((resp != "") && (!resp.StartsWith("y")))
{
Console.WriteLine("Cancelled by user!");
return;
}
try
{
Console.Write("Sending packets...");
int sent = device.PcapSendQueue(squeue, true);
Console.WriteLine("Done!");
if (sent < squeue.CurrentLength)
{
Console.WriteLine("An error occurred sending the packets: {0}. " +
"Only {1} bytes were sent\n", device.PcapLastError, sent);
}
}
catch (Exception e)
{
Console.WriteLine("Error: " + e.Message);
}
//Free the queue
squeue.Dispose();
Console.WriteLine("-- Queue is disposed.");
//Close the pcap device
device.PcapClose();
Console.WriteLine("-- Device closed.");
Console.Write("Hit 'Enter' to exit...");
Console.ReadLine();
}