c# - How to understand a packet is TCP CLOSE packet with sharPcap -
i trying read packets sent clients server. using sharppcap in c#. how can understand packet tcp close packet in event:
private static void device_onpacketarrival(object sender, captureeventargs e) { var time = e.packet.timeval.date; var len = e.packet.data.length; var packet = packetdotnet.packet.parsepacket(e.packet.linklayertype, e.packet.data); var tcppacket = packetdotnet.tcppacket.getencapsulated(packet); if(tcppacket != null) { var ippacket = (packetdotnet.ippacket)tcppacket.parentpacket; system.net.ipaddress srcip = ippacket.sourceaddress; system.net.ipaddress dstip = ippacket.destinationaddress; int srcport = tcppacket.sourceport; int dstport = tcppacket.destinationport; console.writeline("{0}:{1}:{2},{3} len={4} {5}:{6} -> {7}:{8}", time.hour, time.minute, time.second, time.millisecond, len, srcip, srcport, dstip, dstport); } }
a tcp close represented in tcp protocol fin. there going 4 way handshaking close both ends of tcp connection. both ends each send fin, , peer ack it. should able see capturing fromework.
perhaps can find hints here on how implement via api :http://www.codeproject.com/articles/12458/sharppcap-a-packet-capture-framework-for-net
Comments
Post a Comment