示例#1
0
        /// <summary>
        /// Saves packets to a new temp file
        /// </summary>
        /// <param name="basePcapngFile">Possible back file to copy the packets from. Can be null if no such file exists</param>
        /// <param name="packets">List of temporary packets to write. Might be empty ONLY IF <paramref name="basePcapngFile"/> is not NULL</param>
        /// <returns>Path of the temporary PCAP that was created</returns>
        public string WritePackets(PcapngWeakHandle basePcapngFile, IEnumerable <TempPacketSaveData> packets)
        {
            if (basePcapngFile != null)
            {
                return(DoExportBasedOfFile(basePcapngFile, packets));
            }

            if (packets == null || !packets.Any())
            {
                throw new ArgumentNullException(
                          $"WritePackets failed because both {nameof(basePcapngFile)} and {packets} where NULL/empty");
            }

            TimestampHelper tsh = new TimestampHelper(0, 0);

            string pcapngPath = Path.ChangeExtension(Path.GetTempFileName(), "pcapng");
            IEnumerable <LinkLayerType> allLinkLayers = packets.Select(packetData => packetData.LinkLayer).Distinct();

            // A local "Link layer to Interface ID" dictionary
            Dictionary <ushort, int> linkLayerToFakeInterfaceId = new Dictionary <ushort, int>();
            int nextInterfaceId = 0;
            // Collection of face interfaces we need to add
            List <InterfaceDescriptionBlock> ifaceDescBlock = new List <InterfaceDescriptionBlock>();

            foreach (LinkLayerType linkLayer in allLinkLayers)
            {
                InterfaceDescriptionBlock ifdb = new InterfaceDescriptionBlock((LinkTypes)linkLayer, ushort.MaxValue,
                                                                               new InterfaceDescriptionOption(Comment: null, Name: "Fake interface " + nextInterfaceId));
                ifaceDescBlock.Add(ifdb);
                linkLayerToFakeInterfaceId.Add((ushort)linkLayer, nextInterfaceId);

                nextInterfaceId++;
            }

            // Place all interfaaces in a header
            HeaderWithInterfacesDescriptions hwid =
                new HeaderWithInterfacesDescriptions(SectionHeaderBlock.GetEmptyHeader(false), ifaceDescBlock);


            Haukcode.PcapngUtils.PcapNG.PcapNGWriter ngWriter = new PcapNGWriter(pcapngPath, new List <HeaderWithInterfacesDescriptions>()
            {
                hwid
            });
            foreach (TempPacketSaveData packet in packets)
            {
                int    interfaceId      = linkLayerToFakeInterfaceId[(ushort)packet.LinkLayer];
                byte[] packetData       = packet.Data;
                EnhancedPacketBlock epb = new EnhancedPacketBlock(interfaceId, tsh, packetData.Length, packetData, new EnhancedPacketOption());
                ngWriter.WritePacket(epb);
            }
            ngWriter.Dispose();

            return(pcapngPath);
        }
示例#2
0
        public static void WritePcapFile()
        {
            //IPacket packet = new PcapPacket();
            //PcapNGWriter writer = new PcapNGWriter(@"d:\temp\new.pcap");
            // writer.WritePacket();

            using (var reader = new PcapReader(@"d:\temp\2020-05-16-20-08.pcap"))
            {
                using (var writer = new PcapNGWriter(@"d:\temp\new.pcap"))
                {
                    CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
                    {
                        writer.WritePacket(packet);
                    };
                    CancellationTokenSource tokenSource = new CancellationTokenSource();
                    reader.OnReadPacketEvent += handler;
                    reader.ReadPackets(tokenSource.Token);
                    reader.OnReadPacketEvent -= handler;
                }
            }
        }