private static Session[] _DumpTCPTraffic(Dictionary <string, TCPStream> dictTCP) { List <Session> list = new List <Session>(); foreach (KeyValuePair <string, TCPStream> current in dictTCP) { TCPStream value = current.Value; TCPStream tcpsPeer = current.Value.tcpsPeer; if (tcpsPeer == null || tcpsPeer.IsServer) { TCPStreamContent tCPStreamContent = current.Value.ctContentType & ~(TCPStreamContent.Client | TCPStreamContent.Server); if (tCPStreamContent != TCPStreamContent.HTTP) { if (tCPStreamContent == TCPStreamContent.SSLTLS) { list.AddRange(PacketCaptureImport.GetHTTPSHandshakeFromStreams(value, tcpsPeer)); } } else { list.AddRange(PacketCaptureImport.GetSessionsFromStreams(value, tcpsPeer)); } } } list.Sort((Session a, Session b) => a.Timers.ClientBeginRequest.CompareTo(b.Timers.ClientBeginRequest)); foreach (Session current2 in list) { current2.state = (SessionStates)11; } return(list.ToArray()); }
private static List <Session> GetSessionsFromStreams(TCPStream tcpsClient, TCPStream tcpsServer) { StringBuilder stringBuilder = null; if (PacketCaptureImport.bVerboseDebug) { stringBuilder = new StringBuilder(); } if (stringBuilder != null) { stringBuilder.AppendFormat("Connection {0}\nREQUEST\n", tcpsClient.sStreamID); } MemoryStream payloadStream = tcpsClient.GetPayloadStream(stringBuilder, 0); if (stringBuilder != null) { stringBuilder.AppendFormat("\nRESPONSE\n", new object[0]); } MemoryStream memoryStream; if (tcpsServer != null) { memoryStream = tcpsServer.GetPayloadStream(stringBuilder, 0); } else { memoryStream = new MemoryStream(); } payloadStream.Position = 0L; memoryStream.Position = 0L; List <Session> list = new List <Session>(); int num = 0; bool flag; do { string text = null; SessionTimers sessionTimers = new SessionTimers(); sessionTimers.ClientConnected = tcpsClient.dtConnectStart; if (tcpsServer != null) { sessionTimers.ServerConnected = tcpsServer.dtConnectStart; } sessionTimers.ClientBeginRequest = tcpsClient.GetTimestampAtByte((int)payloadStream.Position); HTTPRequestHeaders hTTPRequestHeaders; byte[] array; flag = Parser.TakeRequest(payloadStream, out hTTPRequestHeaders, out array); sessionTimers.ClientDoneRequest = tcpsClient.GetTimestampAtByte((int)payloadStream.Position - 1); if (flag) { num++; HTTPResponseHeaders hTTPResponseHeaders = null; byte[] emptyByteArray = Utilities.emptyByteArray; bool flag2 = false; if (tcpsServer != null) { sessionTimers.ServerBeginResponse = tcpsServer.GetTimestampAtByte((int)memoryStream.Position); flag2 = Parser.TakeResponse(memoryStream, hTTPRequestHeaders.HTTPMethod, out hTTPResponseHeaders, out emptyByteArray); } if (flag2) { while (flag2 && hTTPResponseHeaders.HTTPResponseCode > 99 && hTTPResponseHeaders.HTTPResponseCode < 200) { text = text + "Eating a HTTP/" + hTTPResponseHeaders.HTTPResponseCode.ToString() + " message from the stream."; flag2 = Parser.TakeResponse(memoryStream, hTTPRequestHeaders.HTTPMethod, out hTTPResponseHeaders, out emptyByteArray); } sessionTimers.ServerDoneResponse = tcpsServer.GetTimestampAtByte((int)memoryStream.Position - 1); } else { hTTPResponseHeaders = Parser.ParseResponse("HTTP/1.1 0 FIDDLER GENERATED - RESPONSE DATA WAS MISSING\r\n\r\n"); } Session session = new Session(hTTPRequestHeaders, array); session.oResponse.headers = hTTPResponseHeaders; session.responseBodyBytes = emptyByteArray; session.oFlags["X-EgressPort"] = (session.oFlags["X-ClientPort"] = tcpsClient.tcpEndpoints.iSrcPort.ToString()); session.oFlags["X-ClientIP"] = tcpsClient.tcpEndpoints.addrSrc.ToString(); session.oFlags["X-HostIP"] = tcpsClient.tcpEndpoints.addrDst.ToString(); session.oFlags["X-HostPort"] = tcpsClient.tcpEndpoints.iDstPort.ToString(); if (!string.IsNullOrEmpty(text)) { session.oFlags["x-fiddler-streaming"] = text; } session.Timers = sessionTimers; if (num > 1) { session.UNSTABLE_SetBitFlag((SessionFlags)24, true); } string sProcessInfo = tcpsClient.sProcessInfo; if (!string.IsNullOrEmpty(sProcessInfo)) { session.oFlags["X-ProcessInfo"] = sProcessInfo; } if (stringBuilder != null) { session.oFlags["X-ConnectionDebugInfo"] = stringBuilder.ToString(); } list.Add(session); } }while (flag); return(list); }
public static Session[] GetHTTPSHandshakeFromStreams(TCPStream tcpsClient, TCPStream tcpsServer) { Session[] result; try { if (tcpsClient == null) { result = new Session[0]; } else { MemoryStream payloadStream = tcpsClient.GetPayloadStream(null, 1024); payloadStream.Position = 0L; MemoryStream memoryStream = null; if (tcpsServer != null) { memoryStream = tcpsServer.GetPayloadStream(null, 1024); memoryStream.Position = 0L; } string text = Utilities.UNSTABLE_DescribeClientHello(payloadStream); string text2 = "No server response was found"; if (memoryStream != null && memoryStream.Length > 0L) { text2 = Utilities.UNSTABLE_DescribeServerHello(memoryStream); } if (string.IsNullOrEmpty(text) && (text2 == null || text2.Length < 48)) { result = new Session[0]; } else { HTTPRequestHeaders hTTPRequestHeaders = new HTTPRequestHeaders(); hTTPRequestHeaders.HTTPMethod = "CONNECT"; hTTPRequestHeaders.RequestPath = string.Format("{0}:{1}", tcpsClient.tcpEndpoints.addrDst, tcpsClient.tcpEndpoints.iDstPort); hTTPRequestHeaders.Add("Host", hTTPRequestHeaders.RequestPath); hTTPRequestHeaders.Add("Fiddler-Import", "Packet capture contained HTTPS traffic. Parsing HTTPS Handshake to show this mock Session."); HTTPResponseHeaders hTTPResponseHeaders = new HTTPResponseHeaders(); hTTPResponseHeaders.SetStatus(200, "Emulated CONNECT Tunnel"); Session session = new Session(hTTPRequestHeaders, Encoding.UTF8.GetBytes(text)); session.oResponse.headers = hTTPResponseHeaders; session.responseBodyBytes = Encoding.UTF8.GetBytes(text2); session.oFlags["X-EgressPort"] = (session.oFlags["X-ClientPort"] = tcpsClient.tcpEndpoints.iSrcPort.ToString()); session.oFlags["X-ClientIP"] = tcpsClient.tcpEndpoints.addrSrc.ToString(); session.oFlags["X-HostIP"] = tcpsClient.tcpEndpoints.addrDst.ToString(); session.oFlags["X-HostPort"] = tcpsClient.tcpEndpoints.iDstPort.ToString(); session.Timers.ClientConnected = tcpsClient.dtConnectStart; session.Timers.ClientBeginRequest = tcpsClient.dtFirstPayload; session.Timers.FiddlerGotRequestHeaders = (session.Timers.FiddlerGotResponseHeaders = new DateTime(0L)); session.Timers.ServerConnected = tcpsServer.dtConnectStart; session.Timers.ServerBeginResponse = tcpsServer.dtFirstPayload; string sProcessInfo = tcpsClient.sProcessInfo; if (!string.IsNullOrEmpty(sProcessInfo)) { session.oFlags["X-ProcessInfo"] = sProcessInfo; } session.UNSTABLE_SetBitFlag((SessionFlags)1, true); result = new Session[] { session }; } } } catch (Exception) { result = new Session[0]; } return(result); }
private Session[] GetSessionsFromNetMonCAP(BinaryReader rdr, uint uiMagic) { NetMonFileHeader netMonFileHeader = NetMonFileHeader.CreateFromReader(rdr, uiMagic); uint[] frameOffsets = netMonFileHeader.GetFrameOffsets(rdr); PacketCaptureImport.PacketCounts packetCounts = default(PacketCaptureImport.PacketCounts); Dictionary <uint, DNSTransaction> dictionary = new Dictionary <uint, DNSTransaction>(); Dictionary <string, TCPStream> dictionary2 = new Dictionary <string, TCPStream>(); uint num = 0u; while ((ulong)num < (ulong)((long)frameOffsets.Length)) { packetCounts.Total += 1u; rdr.BaseStream.Position = (long)((ulong)frameOffsets[(int)((UIntPtr)num)]); NetmonPacketHeader netmonPacketHeader = NetmonPacketHeader.CreateFromReader(rdr, netMonFileHeader.dtCapture); if (netmonPacketHeader.MediaType != MediaTypes.Ethernet && netmonPacketHeader.MediaType != MediaTypes.WFPCapture_Message2V4) { if (PacketCaptureImport.bVerboseDebug) { //FiddlerApplication.get_Log().LogFormat("Skipping frame {0} with MediaType: 0x{1:x}", new object[] //{ // num, // netmonPacketHeader.MediaType //}); } } else { byte[] array = new byte[netmonPacketHeader.PacketSavedSize]; rdr.BaseStream.Position = (long)((ulong)(frameOffsets[(int)((UIntPtr)num)] + 16u)); rdr.BaseStream.Read(array, 0, array.Length); IPFrame iPFrame; if (netmonPacketHeader.MediaType == MediaTypes.WFPCapture_Message2V4) { iPFrame = IPFrame.FakeAsIPFrame(num, array, netmonPacketHeader.dtPacket); } else { iPFrame = IPFrame.ParseAsIPFrame(num, array, netmonPacketHeader.dtPacket); } if (iPFrame != null) { if (iPFrame.IPVersion == 4) { packetCounts.IPv4 += 1u; } else { if (iPFrame.IPVersion == 6) { packetCounts.IPv6 += 1u; } } if (PacketCaptureImport.bVerboseDebug) { //FiddlerApplication.get_Log().LogFormat("Adding frame {0} - {1}", new object[] //{ // num, // iPFrame.ToString() //}); } IPSubProtocols nextProtocol = iPFrame.NextProtocol; if (nextProtocol != IPSubProtocols.TCP) { if (nextProtocol != IPSubProtocols.UDP) { if (nextProtocol == IPSubProtocols.ESP) { if (PacketCaptureImport.bVerboseDebug) { //FiddlerApplication.get_Log().LogFormat("ESP Frame #{0} skipped; parsing NYI", new object[] //{ // iPFrame.iFrameNumber //}); } } } else { UDPMessage uDPMessage = UDPMessage.Parse(iPFrame, array); packetCounts.UDP += 1u; if (WellKnownPorts.DNS == uDPMessage.DstPort) { DNSQuery dNSQuery = DNSQuery.Parse(iPFrame, array); if (dNSQuery.QueryType == DNSQueryType.AddressQuery) { DNSTransaction dNSTransaction; if (!dictionary.TryGetValue(dNSQuery.uiTransactionID, out dNSTransaction)) { dNSTransaction = new DNSTransaction(); dictionary.Add(dNSQuery.uiTransactionID, dNSTransaction); } dNSTransaction.uiTransactionID = dNSQuery.uiTransactionID; dNSTransaction.sQueryForHostname = dNSQuery.sHostname; dNSTransaction.bAAAAQuery = (dNSQuery.QueryType == DNSQueryType.AAAA); dNSTransaction.dtQuerySent = netmonPacketHeader.dtPacket; } } else { if (WellKnownPorts.DNS == uDPMessage.SrcPort) { DNSResponse dNSResponse = DNSResponse.Parse(iPFrame, array); DNSTransaction dNSTransaction2; if (dictionary.TryGetValue(dNSResponse.uiTransactionID, out dNSTransaction2)) { dNSTransaction2.dtResponseReceived = netmonPacketHeader.dtPacket; } } } } } else { TCPFrame tCPFrame = TCPFrame.Parse(iPFrame, array); if (tCPFrame != null) { packetCounts.TCP += 1u; TCPEndpoints tCPEndpoints = new TCPEndpoints(iPFrame.ipSrc, iPFrame.ipDest, tCPFrame.SrcPort, tCPFrame.DstPort); string key = tCPEndpoints.ToString(); TCPStream tCPStream; if (!dictionary2.TryGetValue(key, out tCPStream)) { tCPStream = new TCPStream(tCPEndpoints); uint processTableIndex = netmonPacketHeader.ProcessTableIndex; if ((ulong)processTableIndex < (ulong)((long)netMonFileHeader.arrProcesses.Length)) { tCPStream.sProcessInfo = netMonFileHeader.arrProcesses[(int)((UIntPtr)processTableIndex)]; } dictionary2.Add(key, tCPStream); } tCPStream.AddFrame(tCPFrame); } } } } num += 1u; } return(this.GetSessionsFromPackets(ref packetCounts, dictionary2)); }
private Session[] GetSessionsFromPCAPNG(BinaryReader rdr, uint uiMagic) { PCAPNGFileHeader pCAPNGFileHeader = PCAPNGFileHeader.CreateFromReader(rdr, uiMagic); if (pCAPNGFileHeader.ByteOrderMagic != 439041101u) { Console.WriteLine(String.Format("Sorry, this format is not yet supported. Please contact support.", "Unsupported Byte-Order")); return(null); } if (pCAPNGFileHeader.SectionHeaderLength != pCAPNGFileHeader.RepeatedHeaderLength) { Console.WriteLine(String.Format("Sorry, this file appears to be corrupt. HeaderLength != TrailingHeaderLength. Please contact support.", "File Corrupt")); return(null); } //Console.WriteLine(String.Format("Importing PCAPNG:\n{0}", pCAPNGFileHeader); PacketCaptureImport.PacketCounts packetCounts = default(PacketCaptureImport.PacketCounts); Dictionary <uint, DNSTransaction> dictionary = new Dictionary <uint, DNSTransaction>(); Dictionary <string, TCPStream> dictionary2 = new Dictionary <string, TCPStream>(); long length = rdr.BaseStream.Length; bool flag = false; while (!flag && rdr.BaseStream.Position + 8L <= length) { PCAPNGBlockHeader pCAPNGBlockHeader = PCAPNGBlockHeader.CreateFromReader(rdr); PCAPNGBlockType uiBlockType = pCAPNGBlockHeader.uiBlockType; if (uiBlockType != PCAPNGBlockType.InterfaceDescriptionBlock) { if (uiBlockType != PCAPNGBlockType.EnhancedPacketBlock) { //FiddlerApplication.get_Log().LogString(pCAPNGBlockHeader.ToString()); rdr.ReadBytes((int)(pCAPNGBlockHeader.uiBlockLength - 8u)); } else { packetCounts.Total += 1u; PCAPNGEnhancedPacketHeader pCAPNGEnhancedPacketHeader = PCAPNGEnhancedPacketHeader.CreateFromReader(rdr); if (pCAPNGEnhancedPacketHeader.PacketOriginalSize != pCAPNGEnhancedPacketHeader.PacketSavedSize) { //FiddlerApplication.get_Log().LogFormat("! WARNING: Packet was not stored completely. Stored only {0}/{1} bytes", new object[] //{ // pCAPNGEnhancedPacketHeader.PacketSavedSize, // pCAPNGEnhancedPacketHeader.PacketOriginalSize //}); } byte[] array = rdr.ReadBytes((int)pCAPNGEnhancedPacketHeader.PacketSavedSize); if ((long)array.Length != (long)((ulong)pCAPNGEnhancedPacketHeader.PacketSavedSize)) { //FiddlerApplication.get_Log().LogFormat("! WARNING: File was incomplete. Last frame stored only {0}/{1} bytes", new object[] //{ // array.Length, // pCAPNGEnhancedPacketHeader.PacketSavedSize //}); flag = true; } else { IPFrame iPFrame = IPFrame.ParseAsIPFrame(packetCounts.Total, array, pCAPNGEnhancedPacketHeader.dtPacket); if (iPFrame == null) { rdr.ReadBytes((int)((ulong)(pCAPNGBlockHeader.uiBlockLength - 28u) - (ulong)((long)pCAPNGEnhancedPacketHeader.PacketSavedSize))); } else { if (iPFrame.IPVersion == 4) { packetCounts.IPv4 += 1u; } else { if (iPFrame.IPVersion == 6) { packetCounts.IPv6 += 1u; } } IPSubProtocols nextProtocol = iPFrame.NextProtocol; if (nextProtocol != IPSubProtocols.TCP) { if (nextProtocol != IPSubProtocols.UDP) { if (nextProtocol == IPSubProtocols.ESP) { if (PacketCaptureImport.bVerboseDebug) { //FiddlerApplication.get_Log().LogFormat("ESP Frame #{0} skipped; parsing NYI", new object[] //{ // iPFrame.iFrameNumber //}); } } } else { UDPMessage uDPMessage = UDPMessage.Parse(iPFrame, array); packetCounts.UDP += 1u; if (WellKnownPorts.DNS == uDPMessage.DstPort) { DNSQuery dNSQuery = DNSQuery.Parse(iPFrame, array); if (dNSQuery.QueryType == DNSQueryType.AddressQuery) { DNSTransaction dNSTransaction; if (!dictionary.TryGetValue(dNSQuery.uiTransactionID, out dNSTransaction)) { dNSTransaction = new DNSTransaction(); dictionary.Add(dNSQuery.uiTransactionID, dNSTransaction); } dNSTransaction.uiTransactionID = dNSQuery.uiTransactionID; dNSTransaction.sQueryForHostname = dNSQuery.sHostname; dNSTransaction.bAAAAQuery = (dNSQuery.QueryType == DNSQueryType.AAAA); dNSTransaction.dtQuerySent = pCAPNGEnhancedPacketHeader.dtPacket; } } else { if (WellKnownPorts.DNS == uDPMessage.SrcPort) { DNSResponse dNSResponse = DNSResponse.Parse(iPFrame, array); DNSTransaction dNSTransaction2; if (dictionary.TryGetValue(dNSResponse.uiTransactionID, out dNSTransaction2)) { dNSTransaction2.dtResponseReceived = pCAPNGEnhancedPacketHeader.dtPacket; } } } } } else { TCPFrame tCPFrame = TCPFrame.Parse(iPFrame, array); if (tCPFrame == null) { continue; } packetCounts.TCP += 1u; TCPEndpoints tCPEndpoints = new TCPEndpoints(iPFrame.ipSrc, iPFrame.ipDest, tCPFrame.SrcPort, tCPFrame.DstPort); string key = tCPEndpoints.ToString(); TCPStream tCPStream; if (!dictionary2.TryGetValue(key, out tCPStream)) { tCPStream = new TCPStream(tCPEndpoints); dictionary2.Add(key, tCPStream); } tCPStream.AddFrame(tCPFrame); } int count = (int)((ulong)(pCAPNGBlockHeader.uiBlockLength - 28u) - (ulong)((long)pCAPNGEnhancedPacketHeader.PacketSavedSize)); rdr.ReadBytes(count); } } } } else { //FiddlerApplication.get_Log().LogString(pCAPNGBlockHeader.ToString()); rdr.ReadBytes((int)(pCAPNGBlockHeader.uiBlockLength - 8u)); } } return(this.GetSessionsFromPackets(ref packetCounts, dictionary2)); }
private Session[] GetSessionsFromPCAP(BinaryReader rdr, uint uiMagic) { PCAPFileHeader pCAPFileHeader = PCAPFileHeader.CreateFromReader(rdr, uiMagic); if (pCAPFileHeader.IsByteOrderSwapped && !PacketCaptureImport.bSilent) { Console.WriteLine(String.Format("Warning: Byte order swapped. Import will fail!", "FILE FORMAT WARNING")); } if (pCAPFileHeader.LinkType != 1u && !PacketCaptureImport.bSilent) { Console.WriteLine(String.Format("Warning: Link Type is not Ethernet. Import likely to fail!", "FILE FORMAT WARNING")); } //Console.WriteLine(String.Format("Importing PCAP:\n{0}", pCAPFileHeader)); PacketCaptureImport.PacketCounts packetCounts = default(PacketCaptureImport.PacketCounts); Dictionary <uint, DNSTransaction> dictionary = new Dictionary <uint, DNSTransaction>(); Dictionary <string, TCPStream> dictionary2 = new Dictionary <string, TCPStream>(); long length = rdr.BaseStream.Length; bool flag = false; //Console.WriteLine(String.Format("length #{0}\n", length)); while (!flag && rdr.BaseStream.Position + 16L <= length) { packetCounts.Total += 1u; //Console.WriteLine(String.Format("packetCounts.Total : {0}", packetCounts.Total)); PCAPPacketHeader pCAPPacketHeader = PCAPPacketHeader.CreateFromReader(rdr); if (14u > pCAPPacketHeader.PacketSavedSize) { //Console.WriteLine("14u > pCAPPacketHeader.PacketSavedSize"); rdr.BaseStream.Position += (long)pCAPPacketHeader.PacketSavedSize; } else { if (pCAPPacketHeader.PacketOriginalSize != pCAPPacketHeader.PacketSavedSize) { Console.WriteLine(String.Format("! WARNING: Packet{0} was not stored completely. Stored only {1}/{2} bytes", packetCounts.Total, pCAPPacketHeader.PacketSavedSize, pCAPPacketHeader.PacketOriginalSize)); } byte[] array = rdr.ReadBytes((int)pCAPPacketHeader.PacketSavedSize); //hidd3ncodes: Trying to skip this packet. if (pCAPPacketHeader.PacketOriginalSize != pCAPPacketHeader.PacketSavedSize) { continue; } if ((long)array.Length != (long)((ulong)pCAPPacketHeader.PacketSavedSize)) { Console.WriteLine(String.Format("! WARNING: File was incomplete. Last frame stored only {0}/{1} bytes", array.Length, pCAPPacketHeader.PacketSavedSize)); flag = true; } else { IPFrame iPFrame = IPFrame.ParseAsIPFrame(packetCounts.Total, array, pCAPPacketHeader.dtPacket); if (iPFrame != null) { if (iPFrame.IPVersion == 4) { packetCounts.IPv4 += 1u; } else { if (iPFrame.IPVersion == 6) { packetCounts.IPv6 += 1u; } } IPSubProtocols nextProtocol = iPFrame.NextProtocol; if (nextProtocol != IPSubProtocols.TCP) { if (nextProtocol != IPSubProtocols.UDP) { if (nextProtocol == IPSubProtocols.ESP) { //if (PacketCaptureImport.bVerboseDebug) //{ Console.WriteLine(String.Format("ESP Frame #{0} skipped; parsing NYI", iPFrame.iFrameNumber)); //} } } else { UDPMessage uDPMessage = UDPMessage.Parse(iPFrame, array); packetCounts.UDP += 1u; if (WellKnownPorts.DNS == uDPMessage.DstPort) { DNSQuery dNSQuery = DNSQuery.Parse(iPFrame, array); if (dNSQuery.QueryType == DNSQueryType.AddressQuery) { DNSTransaction dNSTransaction; if (!dictionary.TryGetValue(dNSQuery.uiTransactionID, out dNSTransaction)) { dNSTransaction = new DNSTransaction(); dictionary.Add(dNSQuery.uiTransactionID, dNSTransaction); } dNSTransaction.uiTransactionID = dNSQuery.uiTransactionID; dNSTransaction.sQueryForHostname = dNSQuery.sHostname; dNSTransaction.bAAAAQuery = (dNSQuery.QueryType == DNSQueryType.AAAA); dNSTransaction.dtQuerySent = pCAPPacketHeader.dtPacket; } } else { if (WellKnownPorts.DNS == uDPMessage.SrcPort) { DNSResponse dNSResponse = DNSResponse.Parse(iPFrame, array); DNSTransaction dNSTransaction2; if (dictionary.TryGetValue(dNSResponse.uiTransactionID, out dNSTransaction2)) { dNSTransaction2.dtResponseReceived = pCAPPacketHeader.dtPacket; } } } } } else { TCPFrame tCPFrame = TCPFrame.Parse(iPFrame, array); //Console.WriteLine(String.Format("I am here", length)); if (tCPFrame != null) { packetCounts.TCP += 1u; TCPEndpoints tCPEndpoints = new TCPEndpoints(iPFrame.ipSrc, iPFrame.ipDest, tCPFrame.SrcPort, tCPFrame.DstPort); string key = tCPEndpoints.ToString(); TCPStream tCPStream; if (!dictionary2.TryGetValue(key, out tCPStream)) { tCPStream = new TCPStream(tCPEndpoints); dictionary2.Add(key, tCPStream); } tCPStream.AddFrame(tCPFrame); } } } } } //Console.WriteLine(String.Format("Flag #{0}", flag)); //Console.WriteLine(String.Format("rdr.BaseStream.Position #{0}", rdr.BaseStream.Position)); } return(this.GetSessionsFromPackets(ref packetCounts, dictionary2)); }