C# Class SessionViewer.PacketReconstructor

Attempt to try and reconstruct the data portion of a TCP session. We will try and handle duplicates, TCP fragments, and out of order packets in a smart way.

Inheritance: IDisposable

Mostra file Open project: woanware/SessionViewer Class Usage Examples

Public Methods

Method	Description
AddPacketProcessor ( InterfacePacketParser processor ) : void
Dispose ( ) : void
PacketReconstructor ( string outputPath, long maxSize ) : System
ReassemblePacket ( PcapDotNet packet ) : void	The main function of the class receives a tcp packet and reconstructs the stream
SetPacketParsers ( List parsers ) : void

Private Methods

Method	Description
CheckFragments ( long net_src, long net_dst, uint srcport, uint dstport, int index, System.DateTime timestamp, uint acknowledged ) : bool	Search through all the frag we have collected to see if one fits
ReassembleTcp ( ulong sequence, uint acknowledgement, ulong length, byte data, ulong data_length, bool synflag, long net_src, long net_dst, uint srcport, uint dstport, System.DateTime timestamp ) : void	Reconstructs the tcp session
ReassembleUdp ( ulong length, byte data, ulong data_length, long net_src, long net_dst, uint srcport, uint dstport, System.DateTime timestamp ) : int	Reconstructs the tcp session
Reset ( ) : void	Cleans the linked list
SavePacketData ( long net_src, long net_dst, uint srcport, uint dstport, int index, byte data, System.DateTime timestamp ) : void	Writes the payload data to the database

Method Details

AddPacketProcessor() public method

public AddPacketProcessor ( InterfacePacketParser processor ) : void
processor	InterfacePacketParser
return	void

Dispose() public method

public Dispose ( ) : void
return	void

PacketReconstructor() public method

public PacketReconstructor ( string outputPath, long maxSize ) : System
outputPath	string
maxSize	long
return	System

ReassemblePacket() public method

The main function of the class receives a tcp packet and reconstructs the stream

public ReassemblePacket ( PcapDotNet packet ) : void
packet	PcapDotNet
return	void

SetPacketParsers() public method

public SetPacketParsers ( List parsers ) : void
parsers	List
return	void