public void GreIPv4Parsing()
{
var dev = new CaptureFileReaderDevice(NUnitSetupClass.CaptureDirectory + "gre_all_options.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
LinkLayers linkLayers = rawCapture.GetLinkLayers();
if (linkLayers == LinkLayers.Ethernet)
{
Console.WriteLine("Linklayer is ethernet");
// Linklayer
Packet p = Packet.ParsePacket(linkLayers, rawCapture.Data);
Assert.IsNotNull(p);
// Ethernet
EthernetPacket eth = p.Extract <EthernetPacket>();
Assert.IsNotNull(eth);
if (eth.Type == EthernetType.IPv4)
{
Console.WriteLine("IPv4 inside ethernet");
// IPv4
IPv4Packet ipv4 = eth.Extract <IPv4Packet>();
Assert.IsNotNull(ipv4);
if (ipv4.Protocol == ProtocolType.Gre)
{
Console.WriteLine("GRE inside IPv4");
// Gre
GrePacket grep = ipv4.Extract <GrePacket>();
Assert.IsNotNull(grep);
// String output
Console.WriteLine(grep.ToString());
// Get header
if (grep.HasCheckSum)
{
Console.WriteLine("GRE has checksum flag");
}
if (grep.HasKey)
{
Console.WriteLine("GRE has key flag");
}
if (grep.HasReserved)
{
Console.WriteLine("GRE has reserved flag");
}
if (grep.HasSequence)
{
Console.WriteLine("GRE has sequence flag");
}
Assert.AreEqual(grep.Protocol, EthernetType.IPv4);
}
}
}
}
/// <summary>
/// icmp报文分析
/// </summary>
public void icmpProtocol()
{
if (epac.Type.ToString() == "IpV4" && ip4.Protocol.ToString() == "ICMP")
{
var icmppacket = (ICMPv4Packet)ip4.Extract(typeof(ICMPv4Packet));
int LE = (icmppacket.ID / 256) + ((icmppacket.ID % 256) << 8);
int sqLE = (icmppacket.Sequence / 256) + ((icmppacket.Sequence % 256) << 8);
string data1 = "";
IcmpInforArray.Add("Type: " + Convert.ToString(icmppacket.Bytes[0], 10) + ")\n");
IcmpInforArray.Add("Code: " + Convert.ToString(icmppacket.Bytes[1], 10) + "\n");
IcmpInforArray.Add("Checksum: 0x" + Convert.ToString(icmppacket.Checksum, 16).PadLeft(4, '0') + "\n");
IcmpInforArray.Add("Identifier(BE): " + icmppacket.ID.ToString() + " (0x" + Convert.ToString(icmppacket.ID, 16).PadLeft(4, '0') + ")\n");
IcmpInforArray.Add("Identifier(LE): " + LE.ToString() + " (0x" + Convert.ToString(LE, 16).PadLeft(4, '0') + ")\n");
IcmpInforArray.Add("Sequence number(BE): " + icmppacket.Sequence.ToString() + " (0x" + Convert.ToString(icmppacket.Sequence, 16).PadLeft(4, '0') + ")\n");
IcmpInforArray.Add("Sequence number(LE): " + sqLE.ToString() + " (0x" + Convert.ToString(sqLE, 16).PadLeft(4, '0') + ")\n");
for (int i = icmppacket.Header.Length; i < icmppacket.Bytes.Length; i++)
{
data1 = data1 + Convert.ToChar(icmppacket.Bytes[i]);
}
IcmpInforArray.Add("Data: " + data1 + "\n");
KeyWords.Add(icmppacket.ID.ToString().ToUpper());
KeyWords.Add(icmppacket.Sequence.ToString().ToUpper());
this.color = "Gold";
this.data = Encoding.UTF8.GetString(icmppacket.PayloadData);
this.information = " id=" + icmppacket.ID.ToString() + ", seq=" + icmppacket.Sequence.ToString() + ", ttl=" + ip4.TimeToLive.ToString();
}
else if (epac.Type.ToString() == "IpV6")
{
var icmppacket = (ICMPv6Packet)ip6.Extract(typeof(ICMPv6Packet));
try {
IcmpInforArray.Add("Type: " + icmppacket.Type.ToString() + "\n");
}
catch {
;
}
IcmpInforArray.Add("Checksum: " + icmppacket.Checksum.ToString() + "\n");
IcmpInforArray.Add("Code: " + icmppacket.Code.ToString() + "\n");
IcmpInforArray.Add("Identifier: " + Convert.ToString(icmppacket.Bytes[4], 10) + "\n");
KeyWords.Add(Convert.ToString(icmppacket.Bytes[4], 10).ToUpper());
this.color = "Gold";
//this.information = icmppacket.Type.ToString() + "id = " + Convert.ToString(icmppacket.Bytes[4], 10);
}
else
{
MessageBox.Show("ICMPv6");
;
}
}
public void Poison(ref IPv4Packet packet)
{
UdpPacket udp_packet = packet.Extract(typeof(UdpPacket)) as UdpPacket;
if (udp_packet == null || udp_packet.SourcePort != 53)
{
return;
}
DNSRequest dnsRequest = new DNSRequest(udp_packet.Bytes);
bool updated = false;
foreach (KeyValuePair <string, IPAddress> valeur in Resolutions)
{
foreach (DNSResourceRecord record in dnsRequest.Answers)
{
RFC1035.A field_a = record.Details as RFC1035.A;
if (field_a == null)
{
continue;
}
Debug.Print("Domain name: {0}", record.Name);
if (record.Name.EndsWith(valeur.Key) || updated)
{
field_a.ipAddress = valeur.Value;
updated = true;
}
}
if (updated)
{
break;
}
}
if (updated)
{
udp_packet = new UdpPacket(new PacketDotNet.Utils.ByteArraySegment(dnsRequest.ToByte()));
}
}