C# SharpPcap Probleme

Question

Ich habe mich sehr für die Verwendung SharpPcap interessiert, aber bisher ist es nicht gut gelaufen.

Das Hauptproblem ist der folgende Code:

private static void device_OnPacketArrival(object sender, CaptureEventArgs packet) 
    { 
     if(packet is TCPPacket) 
     {     
      DateTime time = packet.Timeval.Date; 
      int len = packet.PcapHeader.len; 

      TCPPacket tcp = (TCPPacket)packet; 
      string srcIp = tcp.SourceAddress; 
      string dstIp = tcp.DestinationAddress; 
      int srcPort = tcp.SourcePort; 
      int dstPort = tcp.DestinationPort; 

      Console.WriteLine("{0}:{1}:{2}, 
       {3} Len={4} {5}:{6} -> {7}:{8}", 
       time.Hour, time.Minute, time.Second, 
       time.Millisecond, len, srcIp, srcPort, 
       dstIp, dstPort); 
     } 
    } 

"The type or namespace TCPPacket could not be found"

OK, so dachte ich, es muss TcpPacket sein? -aber dann kam es mit diesem Fehler auf:

"The given expression is never of the provided ('PacketDotNet.TcpPacket') type"

ignorierend, dass:

"'SharpPcap.CaptureEventArgs' does not contain a definition for 'Timeval' and no extension method 'Timeval' accepting a first argument of type 'SharpPcap.CaptureEventArgs' could be found"

Und so weiter, und so weiter. Also meine Frage ist, vermisse ich etwas?

Ich habe die PacketDotNet und SharpPcap-Bibliothek, und fügte die using-Anweisungen.

Lösung: Paket pack = Packet.ParsePacket (packet.Packet); TcpPacket tcpPacket = TcpPacket.GetEncapsulated (pack);

DateTime time = packet.Packet.Timeval.Date; 
    int len = packet.Packet.Data.Length; 

    if (tcpPacket != null) 
    { 
     IpPacket ipPacket = (IpPacket)tcpPacket.ParentPacket; 


      IPAddress srcIp = ipPacket.SourceAddress; 
      IPAddress dstIp = ipPacket.DestinationAddress; 
      ushort srcPort = tcpPacket.SourcePort; 
      ushort dstPort = tcpPacket.DestinationPort; 

      MessageBox.Show(String.Format("{0}:{1}:{2},{3} Len={4} {5}:{6} -> {7}:{8}", 
           time.Hour, time.Minute, time.Second, time.Millisecond, len, 
           srcIp, srcPort, dstIp, dstPort) 
       ); 
    } 

Answer 1

Lösung:

Packet pack = Packet.ParsePacket(packet.Packet); 
TcpPacket tcpPacket = TcpPacket.GetEncapsulated(pack); 

DateTime time = packet.Packet.Timeval.Date; 
int len = packet.Packet.Data.Length; 

if (tcpPacket != null) 
{ 
    IpPacket ipPacket = (IpPacket)tcpPacket.ParentPacket; 


     IPAddress srcIp = ipPacket.SourceAddress; 
     IPAddress dstIp = ipPacket.DestinationAddress; 
     ushort srcPort = tcpPacket.SourcePort; 
     ushort dstPort = tcpPacket.DestinationPort; 

     MessageBox.Show(String.Format("{0}:{1}:{2},{3} Len={4} {5}:{6} -> {7}:{8}", 
          time.Hour, time.Minute, time.Second, time.Millisecond, len, 
          srcIp, srcPort, dstIp, dstPort) 
      ); 
} 

Answer 2

am ersten Teil des Codes der Suche ...

private static void device_OnPacketArrival(object sender, CaptureEventArgs packet) 
    { 
     if(packet is TCPPacket) 
     {  

Paket scheint CaptureEventArgs vom Typ, nicht TCPPacket zu sein. Wahrscheinlich gibt es eine Eigenschaft der Event-Argumente, die Ihr tatsächliches Paket ist. Wenn das korrekt ist, dann ist das wahrscheinlich wahr aus diesem Grund; Die CaptureEventArgs und das Paket sind nicht dasselbe.

EDIT:

Ich möchte etwas versuchen:

private static void device_OnPacketArrival(object sender, CaptureEventArgs packet) 
    { 
     if(packet.packet is TCPPacket) 
     {    
      TCPPacket tcpPack = (TCPPacket)(packet.packet); 
      DateTime time = tcpPack.Timeval.Date; 
      int len = tcpPack.PcapHeader.len;   
      string srcIp = tcpPack.SourceAddress; 
      string dstIp = tcpPack.DestinationAddress; 
      int srcPort = tcpPack.SourcePort; 
      int dstPort = tcpPack.DestinationPort; 

      Console.WriteLine("{0}:{1}:{2}, 
       {3} Len={4} {5}:{6} -> {7}:{8}", 
       time.Hour, time.Minute, time.Second, 
       time.Millisecond, len, srcIp, srcPort, 
       dstIp, dstPort); 
     } 
    }