// tcp
public void VerifyPacket1(Packet p)
{
Console.WriteLine(p.ToString());
EthernetPacket e = (EthernetPacket)p;
Assert.AreEqual("00:16:cf:c9:1e:29", e.SourceHwAddress);
Assert.AreEqual("00:14:bf:f2:ef:0a", e.DestinationHwAddress);
IPPacket ip = (IPPacket)p;
Assert.AreEqual(System.Net.IPAddress.Parse("192.168.1.104"), ip.SourceAddress);
Assert.AreEqual(System.Net.IPAddress.Parse("86.42.196.13"), ip.DestinationAddress);
Assert.AreEqual(64, ip.TimeToLive);
Assert.AreEqual(0x2ff4, ip.ComputeIPChecksum());
Assert.AreEqual(1171483600, ip.Timeval.Seconds);
Assert.AreEqual(125234.000, ip.Timeval.MicroSeconds);
TCPPacket tcp = (TCPPacket)(p);
Assert.AreEqual(56925, tcp.SourcePort);
Assert.AreEqual(50199, tcp.DestinationPort);
Assert.IsTrue(tcp.Ack);
Assert.IsTrue(tcp.Psh);
Assert.AreEqual(16666, tcp.WindowSize);
Assert.AreEqual(0x2ff4, tcp.ComputeIPChecksum());
Assert.AreEqual(0x9b02, tcp.ComputeTCPChecksum());
Assert.AreEqual(0x9b02, tcp.Checksum);
Assert.IsTrue(tcp.ValidTCPChecksum);
}
public static void SendTcpSyn(NetworkDevice dev)
{
byte[] bytes = new byte[54];
TCPPacket tcp = new TCPPacket(lLen, bytes, true);
//Ethernet fields
tcp.SourceHwAddress = dev.MacAddress; //Set the source mac of the local device
tcp.DestinationHwAddress = destMAC; //Set the dest MAC of the gateway
tcp.EthernetProtocol = EthernetProtocols_Fields.IP;
//IP fields
tcp.DestinationAddress = destIP; //The IP of the destination host
tcp.SourceAddress = dev.IpAddress; //The IP of the local device
tcp.IPProtocol = IPProtocols_Fields.TCP;
tcp.TimeToLive = 20;
tcp.Id = 100;
tcp.Version = 4;
tcp.IPTotalLength = bytes.Length - lLen; //Set the correct IP length
tcp.IPHeaderLength = IPFields_Fields.IP_HEADER_LEN;
//TCP fields
tcp.SourcePort = sourcePort; //The TCP source port
tcp.DestinationPort = destPort; //The TCP dest port
tcp.Syn = true; //Set the SYN flag on
tcp.WindowSize = 555;
tcp.AcknowledgementNumber = 1000;
tcp.SequenceNumber = 1000;
tcp.TCPHeaderLength = TCPFields_Fields.TCP_HEADER_LEN; //Set the correct TCP header length
//tcp.SetData( System.Text.Encoding.ASCII.GetBytes("HELLO") );
//Calculate checksums
tcp.ComputeIPChecksum();
tcp.ComputeTCPChecksum();
dev.PcapOpen(true, 20);
//Set a filter to capture only replies
dev.PcapSetFilter("ip src " + destIP + " and ip dst " +
dev.IpAddress + " and tcp src port " + destPort + " and tcp dst port " + sourcePort);
//Send the packet
Console.Write("Sending packet: " + tcp + "...");
dev.PcapSendPacket(tcp);
Console.WriteLine("Packet sent.");
//Holds the reply
Packet reply;
//Wait till you get a reply
while ((reply = dev.PcapGetNextPacket()) == null)
{
;
}
//print the reply
Console.WriteLine("Reply received: " + reply);
dev.PcapClose();
}
// tcp
public void VerifyPacket0(Packet p)
{
Console.WriteLine(p.ToString());
EthernetPacket e = (EthernetPacket)p;
Assert.AreEqual(PhysicalAddress.Parse("00-13-10-03-71-47"), e.SourceHwAddress);
Assert.AreEqual(PhysicalAddress.Parse("00-E0-4C-E5-73-AD"), e.DestinationHwAddress);
IPPacket ip = (IPPacket)p;
Assert.AreEqual(System.Net.IPAddress.Parse("82.165.240.134"), ip.SourceAddress);
Assert.AreEqual(System.Net.IPAddress.Parse("192.168.1.221"), ip.DestinationAddress);
Assert.AreEqual(IPPacket.IPVersions.IPv4, ip.IPVersion);
Assert.AreEqual(IPProtocol.IPProtocolType.TCP, ip.IPProtocol);
Assert.AreEqual(254, ip.TimeToLive);
Assert.AreEqual(0x0df8, ip.ComputeIPChecksum());
Assert.AreEqual(1176685346, ip.Timeval.Seconds);
Assert.AreEqual(885259.000, ip.Timeval.MicroSeconds);
TCPPacket tcp = (TCPPacket)(p);
Assert.AreEqual(80, tcp.SourcePort);
Assert.AreEqual(4324, tcp.DestinationPort);
Assert.IsTrue(tcp.Ack);
Assert.AreEqual(3536, tcp.WindowSize);
Assert.AreEqual(0x0df8, tcp.ComputeIPChecksum());
Assert.AreEqual(0xc835, tcp.ComputeTCPChecksum());
Assert.AreEqual(0xc835, tcp.Checksum);
Assert.IsTrue(tcp.ValidTCPChecksum);
}
private static void device_PcapOnPacketArrival(object sender, PcapCaptureEventArgs e)
{
if (e.Packet is EthernetPacket)
{
EthernetPacket eth = ((EthernetPacket)e.Packet);
Console.WriteLine("Original Eth packet: " + eth.ToColoredString(false));
//Manipulate ethernet parameters
eth.SourceHwAddress = PhysicalAddress.Parse("00-11-22-33-44-55");
eth.DestinationHwAddress = PhysicalAddress.Parse("00-99-88-77-66-55");
if (e.Packet is IPPacket)
{
IPPacket ip = ((IPPacket)e.Packet);
Console.WriteLine("Original IP packet: " + ip.ToColoredString(false));
//manipulate IP parameters
ip.SourceAddress = System.Net.IPAddress.Parse("1.2.3.4");
ip.DestinationAddress = System.Net.IPAddress.Parse("44.33.22.11");
ip.TimeToLive = 11;
//Recalculate the IP checksum
ip.ComputeIPChecksum();
if (ip is TCPPacket)
{
TCPPacket tcp = ((TCPPacket)ip);
Console.WriteLine("Original TCP packet: " + tcp.ToColoredString(false));
//manipulate TCP parameters
tcp.SourcePort = 9999;
tcp.DestinationPort = 8888;
tcp.Syn = !tcp.Syn;
tcp.Fin = !tcp.Fin;
tcp.Ack = !tcp.Ack;
tcp.WindowSize = 500;
tcp.AcknowledgmentNumber = 800;
tcp.SequenceNumber = 800;
//Recalculate the TCP checksum
tcp.ComputeTCPChecksum();
}
if (ip is UDPPacket)
{
UDPPacket udp = ((UDPPacket)ip);
Console.WriteLine("Original UDP packet: " + udp.ToColoredString(false));
//manipulate UDP parameters
udp.SourcePort = 9999;
udp.DestinationPort = 8888;
//Recalculate the UDP checksum
udp.ComputeUDPChecksum();
}
}
Console.WriteLine("Manipulated Eth packet: " + eth.ToColoredString(false));
}
}
private static void device_PcapOnPacketArrival(object sender, Tamir.IPLib.Packets.Packet packet)
{
if (packet is EthernetPacket)
{
EthernetPacket eth = ((EthernetPacket)packet);
Console.WriteLine("Original packet: " + eth.ToColoredString(false));
//Manipulate ethernet parameters
eth.SourceHwAddress = "00:11:22:33:44:55";
eth.DestinationHwAddress = "00:99:88:77:66:55";
if (packet is IPPacket)
{
IPPacket ip = ((IPPacket)packet);
//manipulate IP parameters
ip.SourceAddress = "1.2.3.4";
ip.DestinationAddress = "44.33.22.11";
ip.TimeToLive = 11;
//Recalculate the IP checksum
ip.ComputeIPChecksum();
if (ip is TCPPacket)
{
TCPPacket tcp = ((TCPPacket)ip);
//manipulate TCP parameters
tcp.SourcePort = 9999;
tcp.DestinationPort = 8888;
tcp.Syn = !tcp.Syn;
tcp.Fin = !tcp.Fin;
tcp.Ack = !tcp.Ack;
tcp.WindowSize = 500;
tcp.AcknowledgementNumber = 800;
tcp.SequenceNumber = 800;
//Recalculate the TCP checksum
tcp.ComputeTCPChecksum();
}
if (ip is UDPPacket)
{
UDPPacket udp = ((UDPPacket)ip);
//manipulate UDP parameters
udp.SourcePort = 9999;
udp.DestinationPort = 8888;
//Recalculate the UDP checksum
udp.ComputeUDPChecksum();
}
}
Console.WriteLine("Manipulated packet: " + eth.ToColoredString(false));
}
}
public TCPPacket CreateTcpPacket(IPv4Packet ipv4Packet)
{
TCPPacket tcpPacket = new TCPPacket(
EthernetFields_Fields.ETH_HEADER_LEN,
ipv4Packet.Bytes);
// TCP fields
tcpPacket.SourcePort = Int32.Parse(textBoxSourcePort.Text);
tcpPacket.DestinationPort = Int32.Parse(textBoxDestinationPort.Text);
tcpPacket.SequenceNumber = Int64.Parse(textBoxSeqNumber.Text);
tcpPacket.AcknowledgmentNumber = Int64.Parse(textBoxAckNumber.Text);
// AllFlags field includes TCPHeaderLength field, so it must be set first
tcpPacket.AllFlags = Int32.Parse(textBoxFlags.Text);
tcpPacket.TCPHeaderLength = Int32.Parse(textBoxHeaderLength.Text);
tcpPacket.WindowSize = Int32.Parse(textBoxWindowSize.Text);
tcpPacket.UrgentPointer = Int32.Parse(textBoxUrgentPointer.Text);
// Calculate checksum
tcpPacket.ComputeTCPChecksum(true);
return tcpPacket;
}
public void TCPChecksumIPv6()
{
PcapOfflineDevice dev = Pcap.GetPcapOfflineDevice("../../capture_files/ipv6_http.pcap");
dev.Open();
Packet p;
// checksums from wireshark of the capture file
int[] expectedChecksum = { 0x41a2,
0x4201,
0x5728,
0xf448,
0xee07,
0x939c,
0x63e4,
0x4590,
0x3725,
0x3723 };
int packetIndex = 0;
while ((p = dev.GetNextPacket()) != null)
{
Assert.IsTrue(p is TCPPacket);
TCPPacket t = (TCPPacket)p;
Assert.IsTrue(t.ValidChecksum);
// compare the computed checksum to the expected one
Assert.AreEqual(expectedChecksum[packetIndex],
t.ComputeTCPChecksum());
packetIndex++;
}
dev.Close();
}
public bool connect(IPEndPoint ipEnd, int port)
{
int lLen = EthernetFields_Fields.ETH_HEADER_LEN;
//SYN packet creation
#region Various Initializations
ARP arper = new ARP();
var bytes = new byte[54];
var tcp = new TCPPacket(lLen, bytes, true)
{
IPVersion = IPPacket.IPVersions.IPv4
};
#endregion
#region Ethernet Fields
tcp.SourceHwAddress = _dev.Interface.MacAddress;
arper.DeviceName = _dev.Name;
arper.LocalIP = _dev.Interface.Addresses[1].Addr.ipAddress;
arper.LocalMAC = _dev.Interface.MacAddress;
//MAC address of gateway is provided by arp protocol
tcp.DestinationHwAddress = arper.Resolve(_gatewayAddr, _dev.Name);
tcp.EthernetProtocol = EthernetPacket.EtherType.IP;
#endregion
#region IP Fields
tcp.DestinationAddress = ipEnd.Address;
tcp.SourceAddress = _dev.Interface.Addresses[1].Addr.ipAddress;
tcp.IPProtocol = IPProtocol.IPProtocolType.TCP;
tcp.TimeToLive = 20;
tcp.ipv4.Id = 100;
tcp.ipv4.IPTotalLength = bytes.Length - lLen;
tcp.ipv4.IPHeaderLength = IPv4Fields_Fields.IP_HEADER_LEN;
#endregion
#region TCP Fields
tcp.SourcePort = 2222;
tcp.DestinationPort = port;
tcp.Syn = true;
tcp.WindowSize = 555;
tcp.SequenceNumber = 0;
tcp.TCPHeaderLength = TCPFields_Fields.TCP_HEADER_LEN;
#endregion
//Headers checksum calculations
tcp.ipv4.ComputeIPChecksum();
tcp.ComputeTCPChecksum();
_dev.Open(false, 20);
_dev.SetFilter("ip src " + tcp.DestinationAddress + " and tcp src port " + tcp.DestinationPort + " and tcp dst port " + tcp.SourcePort);
//Send the packet
Console.Write("Sending SYN packet: " + tcp + "...");
_dev.SendPacket(tcp);
Console.WriteLine("SYN Packet sent.");
TCPPacket reply = null;
var watch = new Stopwatch();
bool received = false;
watch.Start();
//Condition including timeout check.
while (watch.ElapsedMilliseconds < _timeout && received != true)
{
if ((reply = (TCPPacket)_dev.GetNextPacket()) != null)
{
Console.WriteLine("SYN ACK Reply received: " + reply);
received = true;
}
}
//A reply hasn't returned
if (!received)
{
_dev.Close();
throw new Exception("TIME_OUT");
}
//Remote host reported closed connection
if (reply.Rst)
{
_dev.Close();
throw new Exception("CLOSED");
}
//Remote host reported opened connection
if (reply.Ack)
{
tcp.Syn = false;
tcp.Rst = true;
tcp.WindowSize = 0;
tcp.ipv4.ComputeIPChecksum();
tcp.ComputeTCPChecksum();
Console.Write("Sending RST packet: " + tcp + "...");
_dev.SendPacket(tcp);
Console.WriteLine("RST Packet sent.");
_dev.Close();
}
return(true);
}
public ScanMessage Connect(IPEndPoint ipEndPoint)
{
// SYN packet creation
//MAC address of gateway is provided by arp protocol
ARP arper = new ARP(device.Name);
arper.LocalIP = device.Interface.Addresses[0].Addr.ipAddress;
arper.LocalMAC = device.Interface.MacAddress;
PhysicalAddress gatewayHwAddress = arper.Resolve(gatewayAddress);
EthernetPacket ethernetHeader = new EthernetPacket(
device.Interface.MacAddress,
gatewayHwAddress,
EthernetPacketType.IPv4,
null);
byte[] content = new byte[
EthernetFields_Fields.ETH_HEADER_LEN +
IPv4Fields_Fields.IP_HEADER_LEN +
TCPFields_Fields.TCP_HEADER_LEN];
IPv4Packet ipv4Packet = new IPv4Packet(
EthernetFields_Fields.ETH_HEADER_LEN,
content);
// Ethernet header
ipv4Packet.EthernetHeader = ethernetHeader.Bytes;
// IP fields
ipv4Packet.Version = 4;
ipv4Packet.IPHeaderLength = IPv4Fields_Fields.IP_HEADER_LEN;
ipv4Packet.IPTotalLength = content.Length - EthernetFields_Fields.ETH_HEADER_LEN;
ipv4Packet.Id = 100;
ipv4Packet.TimeToLive = 20;
ipv4Packet.IPProtocol = IPProtocol.IPProtocolType.TCP;
ipv4Packet.SourceAddress = device.Interface.Addresses[0].Addr.ipAddress;
ipv4Packet.DestinationAddress = ipEndPoint.Address;
ipv4Packet.ComputeIPChecksum(true);
TCPPacket tcpPacket = new TCPPacket(
EthernetFields_Fields.ETH_HEADER_LEN,
content);
// TCP fields
tcpPacket.SourcePort = 2222;
tcpPacket.DestinationPort = ipEndPoint.Port;
tcpPacket.SequenceNumber = 1000;
tcpPacket.AcknowledgmentNumber = 1000;
tcpPacket.Syn = true;
tcpPacket.TCPHeaderLength = TCPFields_Fields.TCP_HEADER_LEN;
tcpPacket.WindowSize = 555;
// Calculate checksum
tcpPacket.ComputeTCPChecksum(true);
try
{
device.Open(false, 20);
device.SetFilter(String.Format("ip src {0} and tcp src port {1} and tcp dst port {2}",
tcpPacket.DestinationAddress,
tcpPacket.DestinationPort,
tcpPacket.SourcePort));
// Send the packet
device.SendPacket(tcpPacket);
TCPPacket replyPacket = null;
bool replyReceived = false;
Stopwatch watch = new Stopwatch();
watch.Start();
// Condition including timeout check.
while (watch.ElapsedMilliseconds < timeout && replyReceived != true)
{
if ((replyPacket = (TCPPacket)device.GetNextPacket()) != null)
{
replyReceived = true;
}
}
if (!replyReceived) // A reply hasn't been received
{
return(ScanMessage.Timeout);
}
else if (replyPacket.Rst) // Remote host reset the connection
{
return(ScanMessage.PortClosed);
}
else if (replyPacket.Ack) // Remote host replied with a TCP packet
{
tcpPacket.Syn = false;
tcpPacket.Rst = true;
tcpPacket.WindowSize = 0;
tcpPacket.ComputeTCPChecksum(true);
device.SendPacket(tcpPacket);
return(ScanMessage.PortOpened);
}
else
{
return(ScanMessage.Unknown);
}
}
catch (Exception)
{
return(ScanMessage.Unknown);
}
finally
{
device.Close();
}
}