示例#1
0
        internal IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference, ISessionProtocolFinder protocolFinder, bool clientToServer)
        {
            if (includeSelfReference)
            {
                yield return(this);
            }
            if (this.PayloadDataLength > 0)
            {
                AbstractPacket packet = null;
                if (protocolFinder.GetConfirmedApplicationLayerProtocol() != ApplicationLayerProtocol.Unknown)
                {
                    try {
                        packet = this.GetProtocolPacket(protocolFinder.GetConfirmedApplicationLayerProtocol(), clientToServer);
                    }
                    catch (Exception e) {
                        SharedUtils.Logger.Log("Error parsing frame " + this.ParentFrame.FrameNumber + " as " + protocolFinder.GetConfirmedApplicationLayerProtocol() + " packet: " + e.Message, SharedUtils.Logger.EventLogEntryType.Error);
                        packet = null;
                    }
                }
                if (packet == null)
                {
                    foreach (ApplicationLayerProtocol protocol in protocolFinder.GetProbableApplicationLayerProtocols())
                    {
                        try {
                            packet = this.GetProtocolPacket(protocol, clientToServer);
                            if (packet != null)
                            {
                                protocolFinder.SetConfirmedApplicationLayerProtocol(protocol, true);
                                break;
                            }
                        }
                        catch (Exception e) {
                            SharedUtils.Logger.Log("Unable to parse frame " + this.ParentFrame.FrameNumber + " as " + protocol + " packet: " + e.Message, SharedUtils.Logger.EventLogEntryType.Warning);
                            packet = null;
                        }
                    }
                }
                if (packet == null)
                {
                    packet = new RawPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex);
                }
                yield return(packet);

                foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
                {
                    yield return(subPacket);
                }
            }
        }
示例#2
0
        internal IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference, ISessionProtocolFinder protocolFinder, bool clientToServer)
        {
            if (includeSelfReference)
            {
                yield return(this);
            }
            if (PacketStartIndex + dataOffsetByteCount < PacketEndIndex)
            {
                AbstractPacket packet = null;
                if (protocolFinder.GetConfirmedApplicationLayerProtocol() != ApplicationLayerProtocol.Unknown)
                {
                    try {
                        packet = this.GetProtocolPacket(protocolFinder.GetConfirmedApplicationLayerProtocol(), clientToServer);
                    }
                    catch { }
                }
                if (packet == null)
                {
                    foreach (ApplicationLayerProtocol protocol in protocolFinder.GetProbableApplicationLayerProtocols())
                    {
                        try {
                            packet = this.GetProtocolPacket(protocol, clientToServer);
                            if (packet != null)
                            {
                                protocolFinder.SetConfirmedApplicationLayerProtocol(protocol, true);
                                break;
                            }

                            /*
                             * if (protocol == ApplicationLayerProtocol.Dns) {
                             *  packet = new DnsPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Dns;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.FtpControl) {
                             *  if (FtpPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.FtpControl;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Http) {
                             *  if (HttpPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Http;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Irc) {
                             *  if (IrcPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Irc;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.IEC_104) {
                             *  if (IEC_60870_5_104Packet.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.IEC_104;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Imap) {
                             *  packet = new ImapPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Imap;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.ModbusTCP) {
                             *  if (ModbusTcpPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, this.sourcePort, this.destinationPort, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.ModbusTCP;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.NetBiosNameService) {
                             *  packet = new NetBiosNameServicePacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.NetBiosNameService;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.NetBiosSessionService) {
                             *  //if (NetBiosSessionService.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *  if (NetBiosSessionService.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, this.sourcePort, this.destinationPort, out packet)) {
                             *      //packet = new NetBiosSessionService(ParentFrame, PacketStartIndex+dataOffsetByteCount, PacketEndIndex, false);
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.NetBiosSessionService;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.OpenFlow) {
                             *  if (OpenFlowPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.OpenFlow;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Oscar) {
                             *  if (OscarPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Oscar;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.OscarFileTransfer) {
                             *  if (OscarFileTransferPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.OscarFileTransfer;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Pop3) {
                             *  packet = new Pop3Packet(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Pop3;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Smtp) {
                             *  packet = new SmtpPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Smtp;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Socks) {
                             *  if (SocksPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Socks;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.SpotifyServerProtocol) {
                             *  if (SpotifyKeyExchangePacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, clientToServer, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.SpotifyServerProtocol;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Ssh) {
                             *  if (SshPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Ssh;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Ssl) {
                             *  if (SslPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Ssl;
                             *      break;
                             *  }
                             * }
                             * else if (protocol == ApplicationLayerProtocol.TabularDataStream) {
                             *  packet = new TabularDataStreamPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex);
                             *  protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.TabularDataStream;
                             *  break;
                             * }
                             * else if (protocol == ApplicationLayerProtocol.Tpkt) {
                             *  if (TpktPacket.TryParse(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex, this, out packet)) {
                             *      protocolFinder.ConfirmedApplicationLayerProtocol = ApplicationLayerProtocol.Tpkt;
                             *      break;
                             *  }
                             * }*/
                        }
                        catch (Exception) {
                            packet = null;
                        }
                    }
                }
                if (packet == null)
                {
                    packet = new RawPacket(ParentFrame, PacketStartIndex + dataOffsetByteCount, PacketEndIndex);
                }
                yield return(packet);

                foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
                {
                    yield return(subPacket);
                }
            }
        }