public static bool Parser(ref TreeNodeCollection mNode, byte [] PacketData, ref int Index, ref ListViewItem LItem) { TreeNode mNodex; string Tmp = ""; PACKET_ARP PArp; mNodex = new TreeNode(); mNodex.Text = "ARP ( Address Resolution Protocol )"; Function.SetPosition(ref mNodex, Index, Const.LENGTH_OF_ARP, true); if ((Index + Const.LENGTH_OF_ARP) > PacketData.Length) { mNode.Add(mNodex); Tmp = "[ Malformed ARP packet. Remaining bytes don't fit an ARP packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp; return(false); } try { PArp.HardwareType = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); Tmp = "Hardware Type : " + Function.ReFormatString(PArp.HardwareType, GetHardwareList(PArp.HardwareType)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); PArp.ProtocolType = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); Tmp = "Protocol Type : " + Function.ReFormatString(PArp.ProtocolType, Const.GetETHERTYPEStr(PArp.ProtocolType)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); PArp.HardwareSize = PacketData[Index++]; Tmp = "Hardware Size : " + Function.ReFormatString(PArp.HardwareSize, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 1, 1, false); PArp.ProtocolSize = PacketData[Index++]; Tmp = "Protocol Size : " + Function.ReFormatString(PArp.ProtocolSize, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 1, 1, false); PArp.OpCode = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); Tmp = "Opcode : " + Function.ReFormatString(PArp.OpCode, GetOpCodeList(PArp.OpCode)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); PArp.SenderMACAddress = Function.GetMACAddress(PacketData, ref Index); Tmp = "Sender MAC Address : " + PArp.SenderMACAddress; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PArp.SenderIpAddress = Function.GetIpAddress(PacketData, ref Index); Tmp = "Sender Ip Address : " + PArp.SenderIpAddress; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 4, 4, false); PArp.TargetMACAddress = Function.GetMACAddress(PacketData, ref Index); Tmp = "Target MAC Address : " + PArp.TargetMACAddress; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PArp.TargetIpAddress = Function.GetIpAddress(PacketData, ref Index); Tmp = "Target Ip Address : " + PArp.TargetIpAddress; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 4, 4, false); LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ARP"; LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PArp.SenderIpAddress; LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PArp.TargetIpAddress; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = GetInfoARP(PArp); mNode.Add(mNodex); } catch (Exception Ex) { mNode.Add(mNodex); Tmp = "[ Malformed ARP packet. Remaining bytes don't fit an ARP packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp; return(false); } return(true); }
public static bool Parser(ref TreeNodeCollection mNode, byte [] PacketData, ref ListViewItem LItem, ref uint PreviousHttpSequence, ref ushort LastTftpPort) { TreeNode mNodex; string Tmp = ""; int Index = 0; PACKET_ETHERNET PEthernet; mNodex = new TreeNode(); mNodex.Text = "ETHERNET"; Function.SetPosition(ref mNodex, Index, Const.LENGTH_OF_ETHERNET, true); if ((Index + Const.LENGTH_OF_ETHERNET) > PacketData.Length) { mNode.Add(mNodex); Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = Tmp; return(false); } try { PEthernet.Destination = Function.GetMACAddress(PacketData, ref Index);; Tmp = "Destination : " + PEthernet.Destination; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PEthernet.Source = Function.GetMACAddress(PacketData, ref Index);; Tmp = "Source : " + PEthernet.Source; mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 6, 6, false); PEthernet.Type = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL); if (PEthernet.Type <= 1500) { Tmp = "Length : " + Function.ReFormatString(PEthernet.Type, null); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); } else { Tmp = "Type : " + Function.ReFormatString(PEthernet.Type, Const.GetETHERTYPEStr(PEthernet.Type)); mNodex.Nodes.Add(Tmp); Function.SetPosition(ref mNodex, Index - 2, 2, false); } LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "ETHERNET"; LItem.SubItems[Const.LIST_VIEW_SOURCE_INDEX].Text = PEthernet.Source; LItem.SubItems[Const.LIST_VIEW_DESTINATION_INDEX].Text = PEthernet.Destination; LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Ethernet protocol"; mNode.Add(mNodex); if (PEthernet.Type <= 1500) { PacketLLC.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort); } else { switch (PEthernet.Type) { case Const.ETHERTYPE_PUP: break; case Const.ETHERTYPE_SPRITE: break; case Const.ETHERTYPE_NS: break; case Const.ETHERTYPE_TRAIL: break; case Const.ETHERTYPE_MOPDL: break; case Const.ETHERTYPE_MOPRC: break; case Const.ETHERTYPE_DN: break; case Const.ETHERTYPE_LAT: break; case Const.ETHERTYPE_SCA: break; case Const.ETHERTYPE_IP: PacketINTERNET.Parser(ref mNode, PacketData, ref Index, ref LItem, ref PreviousHttpSequence, ref LastTftpPort); break; case Const.ETHERTYPE_ARP: PacketARP.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_REVARP: break; case Const.ETHERTYPE_LANBRIDGE: break; case Const.ETHERTYPE_DECDNS: break; case Const.ETHERTYPE_DECDTS: break; case Const.ETHERTYPE_VEXP: break; case Const.ETHERTYPE_VPROD: break; case Const.ETHERTYPE_ATALK: break; case Const.ETHERTYPE_AARP: break; case Const.ETHERTYPE_8021Q: break; case Const.ETHERTYPE_IPX: PacketIPX.Parser(ref mNode, PacketData, ref Index, ref LItem); break; case Const.ETHERTYPE_IPV6: break; case Const.ETHERTYPE_LOOPBACK: PacketLOOPBACK.Parser(ref mNode, PacketData, ref Index, ref LItem); break; } } } catch (Exception Ex) { mNode.Add(mNodex); Tmp = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; mNode.Add(Tmp); Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]"; mNode.Add(Tmp); LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed ETHERNET packet. Remaining bytes don't fit an ETHERNET packet. Possibly due to bad decoding ]"; return(false); } return(true); }