Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5.3 Data Archiving System
5.3.1 Listening for a Connection
The data archiving system is in an always listening state until a connection has been
made, Figure 26 shows that this one is listening on port 13000 for an incoming TCP
connection. When a Client connects it takes records some of its details, and it then
generates an RSA Key Pair, which is then sent t the client.
// Lisetn for a connection on port 13000.
IPEndPoint ipep = new IPEndPoint(IPAddress.Any,13000);
// Create a new socket for the connection.
Socket newsock = new
Socket(AddressFamily.InterNetwork,SocketType.Stream,
ProtocolType.Tcp);
// Bind the socket to the connection.
newsock.Bind(ipep);
// Place the socket into a listening state.
newsock.Listen(10);
Console.WriteLine("Waiting for a client...");
Socket client = newsock.Accept();
IPEndPoint clientep =(IPEndPoint)client.RemoteEndPoint;
// Display a message when a client has connected.
Console.WriteLine("Connected with {0} at port {1}",clientep.Address,
clientep.Port);
5.3.2 Generating Keys
Figure 26: Server Listening for a Connection
Figure 27 shows the routine that was used to generate both the public and private RSA
keys, these keys are then exported to an XML string, the public key gets sent to the
Client and the Private key stays with the data archiving system.
// Specify the size of the key that will be generated.
int dwKeySize = 1024;
// Create a new instance of RSACryptoServiceProvider to generate
// public and private key data using the specified key size.
RSACryptoServiceProvider RSAProvider = new
RSACryptoServiceProvider(dwKeySize);
// Convert the public and private keys into XML format.
string publicAndPrivateKeys = RSAProvider.ToXmlString(true);
// Convert the public key into XML format.
string justPublicKey = RSAProvider.ToXmlString(false);
Figure 27: Generating an RSA Key Pair
45