
Untitled
By: a guest on
Apr 30th, 2012 | syntax:
None | size: 1.15 KB | hits: 24 | expires: Never
public static void device_PcapOnPacketArrival(object sender, CaptureEventArgs e)
{
try
{
var packet = Packet.ParsePacket(LinkLayers.Ethernet, e.Packet.Data);
if (packet.PayloadPacket == null) return;
}
catch
{
return;
}
TcpPacket tcpPacket = Packet.ParsePacket(LinkLayers.Ethernet, e.Packet.Data).PayloadPacket.PayloadPacket as TcpPacket;
// THIS FILTERS D3 TRAFFIC, GS AS WELL AS MOONET
if ((tcpPacket != null) && (tcpPacket.SourcePort == 1119 || tcpPacket.DestinationPort == 1119))
{
Connection c = new Connection(tcpPacket);
if (!sharpPcapDict.ContainsKey(c))
{
string fileName = c.getFileName(path);
TcpRecon tcpRecon = new TcpRecon(fileName);
sharpPcapDict.Add(c, tcpRecon);
}
// Use the TcpRecon class to reconstruct the session
sharpPcapDict[c].ReassemblePacket(tcpPacket);
}
}