public ProbePacket(PacketDotNet.Ieee80211.ProbeRequestFrame probeRequestFrame, DateTime TimeStamp) { this.ProbeRequestFrame = probeRequestFrame; this.TimeStamp = TimeStamp; foreach (InformationElement element in ProbeRequestFrame.InformationElements) { switch (element.Id) { case InformationElement.ElementId.VendorSpecific: { VendorSpecificManufacturer = OuiParser.GetOuiByMac(element.Value); break; } case InformationElement.ElementId.ServiceSetIdentity: { SSID = ASCIIEncoding.ASCII.GetString(element.Value); if (SSID != null && SSID.Length > 0) { IsHidden = SSID[0] == 0; } else if (SSID == "") { IsHidden = true; } break; } } } }
/// <summary> /// Parses the <see cref="PacketDotNet.Utils.ByteArraySegment"/> into a MacFrame. /// </summary> /// <returns> /// The parsed MacFrame or null if it could not be parsed. /// </returns> /// <param name='bas'> /// The bytes of the packet. bas.Offset should point to the first byte in the mac frame. /// </param> /// <remarks>If the provided bytes contain the FCS then call <see cref="MacFrame.ParsePacketWithFcs"/> instead. The presence of the /// FCS is usually determined by configuration of the device used to capture the packets.</remarks> public static MacFrame ParsePacket(ByteArraySegment bas) { if (bas.Length < MacFields.FrameControlLength) { //there isn't enough data to even try and work out what type of packet it is return(null); } //this is a bit ugly as we will end up parsing the framecontrol field twice, once here and once //inside the packet constructor. Could create the framecontrol and pass it to the packet but I think that is equally ugly FrameControlField frameControl = new FrameControlField( EndianBitConverter.Big.ToUInt16(bas.Bytes, bas.Offset)); MacFrame macFrame = null; log.DebugFormat("SubType {0}", frameControl.SubType); switch (frameControl.SubType) { case FrameControlField.FrameSubTypes.ManagementAssociationRequest: { macFrame = new AssociationRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAssociationResponse: { macFrame = new AssociationResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReassociationRequest: { macFrame = new ReassociationRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReassociationResponse: { macFrame = new AssociationResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementProbeRequest: { macFrame = new ProbeRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementProbeResponse: { macFrame = new ProbeResponseFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReserved0: break; //TODO case FrameControlField.FrameSubTypes.ManagementReserved1: break; //TODO case FrameControlField.FrameSubTypes.ManagementBeacon: { macFrame = new BeaconFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementATIM: break; //TODO case FrameControlField.FrameSubTypes.ManagementDisassociation: { macFrame = new DisassociationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAuthentication: { macFrame = new AuthenticationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementDeauthentication: { macFrame = new DeauthenticationFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementAction: { macFrame = new ActionFrame(bas); break; } case FrameControlField.FrameSubTypes.ManagementReserved3: break; //TODO case FrameControlField.FrameSubTypes.ControlBlockAcknowledgmentRequest: { macFrame = new BlockAcknowledgmentRequestFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlBlockAcknowledgment: { macFrame = new BlockAcknowledgmentFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlPSPoll: break; //TODO case FrameControlField.FrameSubTypes.ControlRTS: { macFrame = new RtsFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCTS: { macFrame = new CtsFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlACK: { macFrame = new AckFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCFEnd: { macFrame = new ContentionFreeEndFrame(bas); break; } case FrameControlField.FrameSubTypes.ControlCFEndCFACK: break; //TODO case FrameControlField.FrameSubTypes.Data: case FrameControlField.FrameSubTypes.DataCFACK: case FrameControlField.FrameSubTypes.DataCFPoll: case FrameControlField.FrameSubTypes.DataCFAckCFPoll: { macFrame = new DataDataFrame(bas); break; } case FrameControlField.FrameSubTypes.DataNullFunctionNoData: case FrameControlField.FrameSubTypes.DataCFAckNoData: case FrameControlField.FrameSubTypes.DataCFPollNoData: case FrameControlField.FrameSubTypes.DataCFAckCFPollNoData: { macFrame = new NullDataFrame(bas); break; } case FrameControlField.FrameSubTypes.QosData: case FrameControlField.FrameSubTypes.QosDataAndCFAck: case FrameControlField.FrameSubTypes.QosDataAndCFPoll: case FrameControlField.FrameSubTypes.QosDataAndCFAckAndCFPoll: { macFrame = new QosDataFrame(bas); break; } case FrameControlField.FrameSubTypes.QosNullData: case FrameControlField.FrameSubTypes.QosCFAck: case FrameControlField.FrameSubTypes.QosCFPoll: case FrameControlField.FrameSubTypes.QosCFAckAndCFPoll: { macFrame = new QosNullDataFrame(bas); break; } default: //this is an unsupported (and unknown) packet type break; } return(macFrame); }