internal SpoofDetectionResult ReceiveAndHandleReply(Socket client, Protocol protocol, Byte[] transactionId, IClientActioner clientActioner)
{
IPEndPoint sender = null;
Byte[] replyBuffer;
try
{
replyBuffer = clientActioner.Receive(client, out sender);
}
catch (SocketException ex)
{
if (ex.ErrorCode == 10060) //Timeout
{
return(null);
}
if (ex.ErrorCode == 10004) //Aborted
{
return(null);
}
throw;
}
if (sender == null || replyBuffer.Length <= 0)
{
return(null);
}
var result = new SpoofDetectionResult
{
Confidence = ConfidenceLevel.FalsePositive,
Detected = false,
Endpoint = null,
ErrorMessage = String.Format("Unable to parse packet sent to port {0}",
((IPEndPoint)client.LocalEndPoint)?.Port)
, Protocol = Protocol.Unknown
};
try
{
result = HandleReply(replyBuffer, sender, transactionId, protocol);
}
catch (Exception)
{
//Omnomnom - There's all sorts of reasons the parser might crash on a packet, we need to handle all of them
//until the parser is able to handle those exceptions itself
}
return(result);
}
public Byte[] SendRequest(Socket client, Protocol protocol, String lookupName, String subnetBroadcastAddress, IClientActioner clientActioner)
{
Byte[] transactionId = GenerateTransactionId(protocol);
//Encode NETBIOS name
if (protocol == Protocol.NBNS)
{
lookupName = EncodeNetBiosName(lookupName, 0x20); //File server service
}
Byte[] datagram = CreateRequestDatagram(protocol, lookupName, transactionId);
//Send datagram
if (protocol == Protocol.LLMNR)
{
clientActioner.Send(client, datagram, subnetBroadcastAddress, LLMNROutboundPort);
}
else if (protocol == Protocol.NBNS)
{
clientActioner.Send(client, datagram, subnetBroadcastAddress, NBNSOutboundPort);
}
else if (protocol == Protocol.mDNS)
{
clientActioner.Send(client, datagram, "224.0.0.251", mDNSOutboundPort);
}
else
{
throw new InvalidOperationException("Unknown protocol");
}
return(transactionId);
new UdpClient();
}
