private static void device_OnPacketArrival(object sender, CaptureEventArgs e)
{
var time = e.Packet.Timeval.Date;
var len = e.Packet.Data.Length;
var packet = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
if (packet is EthernetPacket)
{
PacketLimit++;
var eth = ((EthernetPacket)packet);
if (!SourceMac.Contains(eth.SourceHardwareAddress) && !Equals(eth.SourceHardwareAddress, LocalMac))
{
SourceMac.Add(eth.SourceHardwareAddress);
}
}
var tcpPacket = packet.Extract <TcpPacket>();
if (tcpPacket != null)
{
var ipPacket = (IPPacket)tcpPacket.ParentPacket;
var srcIp = ipPacket.SourceAddress;
var dstIp = ipPacket.DestinationAddress;
int srcPort = tcpPacket.SourcePort;
int dstPort = tcpPacket.DestinationPort;
// Console.WriteLine($"SrcIp: {srcIp} | DstIp: {dstIp} | SrcPort: {srcPort} | DstPort: {dstPort}");
}
}
public void SendArpResponse(PacketCommunicator communicator, IpV4Address ipAddress)
{
var ethernetLayer = new EthernetLayer
{
Source = SourceMac,
Destination = DestinationMac,
};
var a = Regex.Matches(SourceMac.ToString().Replace(":", ""), @"\S{2}").Cast <Match>().Select(m => m.Value).ToArray();
var macParsed = new byte[a.Length];
for (int i = 0; i < a.Length; i++)
{
macParsed[i] = (byte)int.Parse(a[i], System.Globalization.NumberStyles.HexNumber);
}
var b = Regex.Matches(DestinationMac.ToString().Replace(":", ""), @"\S{2}").Cast <Match>().Select(m => m.Value).ToArray();
var targetMacParsed = new byte[b.Length];
for (int i = 0; i < b.Length; i++)
{
targetMacParsed[i] = (byte)int.Parse(b[i], System.Globalization.NumberStyles.HexNumber);
}
ArpLayer arpLayer = new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Reply,
SenderHardwareAddress = macParsed.AsReadOnly(),
SenderProtocolAddress = ipAddress.ToString().Split('.').Select(n => Convert.ToByte(n)).ToArray().AsReadOnly(),
TargetHardwareAddress = macParsed.AsReadOnly(),
TargetProtocolAddress = DestinationIpV4.ToString().Split('.').Select(n => Convert.ToByte(n)).ToArray().AsReadOnly(),
};
var packet = PacketBuilder.Build(DateTime.Now, ethernetLayer, arpLayer);
communicator.SendPacket(packet);
}
public bool IsMatch(EthernetPacket packet)
{
var validationStack = new Stack <Func <bool> >();
if (SourceMac != null)
{
validationStack.Push(() => SourceMac.Equals(packet.SourceHardwareAddress));
}
if (DestinationMac != null)
{
validationStack.Push(() => DestinationMac.Equals(packet.DestinationHardwareAddress));
}
var arp = packet.Extract <ArpPacket>();
if (arp != null && RuleProtocol.Equals(Protocol.Arp))
{
return(resolveValidationStack(validationStack));
}
var lldp = packet.Extract <LldpPacket>();
if (lldp != null && RuleProtocol.Equals(Protocol.Lldp))
{
return(resolveValidationStack(validationStack));
}
var ipv4 = packet.Extract <IPv4Packet>();
if (ipv4 != null)
{
if (SourceIp != null)
{
validationStack.Push(() => SourceIp.Equals(ipv4.SourceAddress));
}
if (DestinationIp != null)
{
validationStack.Push(() => DestinationIp.Equals(ipv4.DestinationAddress));
}
if (RuleProtocol.Equals(Protocol.Ipv4))
{
return(resolveValidationStack(validationStack));
}
}
var ipv6 = packet.Extract <IPv6Packet>();
if (ipv6 != null)
{
if (SourceIp != null)
{
validationStack.Push(() => SourceIp.Equals(ipv6.SourceAddress));
}
if (DestinationIp != null)
{
validationStack.Push(() => DestinationIp.Equals(ipv6.DestinationAddress));
}
if (RuleProtocol.Equals(Protocol.Ipv6))
{
return(resolveValidationStack(validationStack));
}
}
var icmpv4 = packet.Extract <IcmpV4Packet>();
if (icmpv4 != null && RuleProtocol.Equals(Protocol.Icmpv4))
{
if (DestinationPort != null)
{
validationStack.Push(() => (((ushort)icmpv4.TypeCode) / 256) == DestinationPort);
}
return(resolveValidationStack(validationStack));
}
var icmpv6 = packet.Extract <IcmpV4Packet>();
if (icmpv6 != null && RuleProtocol.Equals(Protocol.Icmpv6))
{
if (DestinationPort != null)
{
validationStack.Push(() => (((ushort)icmpv6.TypeCode) / 256) == DestinationPort);
}
return(resolveValidationStack(validationStack));
}
var tcp = packet.Extract <TcpPacket>();
if (tcp != null && RuleProtocol.Equals(Protocol.Tcp))
{
if (SourcePort != null)
{
validationStack.Push(() => SourcePort.Equals(tcp.SourcePort));
}
if (DestinationPort != null)
{
validationStack.Push(() => DestinationPort.Equals(tcp.DestinationPort));
}
return(resolveValidationStack(validationStack));
}
var udp = packet.Extract <UdpPacket>();
if (udp != null && RuleProtocol.Equals(Protocol.Udp))
{
if (SourcePort != null)
{
validationStack.Push(() => SourcePort.Equals(udp.SourcePort));
}
if (DestinationPort != null)
{
validationStack.Push(() => DestinationPort.Equals(udp.DestinationPort));
}
return(resolveValidationStack(validationStack));
}
return(false);
}