c# - How to understand a packet is TCP CLOSE packet with sharPcap -


i trying read packets sent clients server. using sharppcap in c#. how can understand packet tcp close packet in event:

    private static void device_onpacketarrival(object sender, captureeventargs e)     {                    var time = e.packet.timeval.date;         var len = e.packet.data.length;          var packet = packetdotnet.packet.parsepacket(e.packet.linklayertype, e.packet.data);          var tcppacket = packetdotnet.tcppacket.getencapsulated(packet);         if(tcppacket != null)         {             var ippacket = (packetdotnet.ippacket)tcppacket.parentpacket;             system.net.ipaddress srcip = ippacket.sourceaddress;             system.net.ipaddress dstip = ippacket.destinationaddress;             int srcport = tcppacket.sourceport;             int dstport = tcppacket.destinationport;              console.writeline("{0}:{1}:{2},{3} len={4} {5}:{6} -> {7}:{8}",                  time.hour, time.minute, time.second, time.millisecond, len,                 srcip, srcport, dstip, dstport);         }     } 

a tcp close represented in tcp protocol fin. there going 4 way handshaking close both ends of tcp connection. both ends each send fin, , peer ack it. should able see capturing fromework.

perhaps can find hints here on how implement via api :http://www.codeproject.com/articles/12458/sharppcap-a-packet-capture-framework-for-net


Comments

Popular posts from this blog

powershell Start-Process exit code -1073741502 when used with Credential from a windows service environment -

twig - Using Twigbridge in a Laravel 5.1 Package -

c# - LINQ join Entities from HashSet's, Join vs Dictionary vs HashSet performance -