Application Layer Covert Channel Analysis and ... - Bill Buchanan
Application Layer Covert Channel Analysis and ... - Bill Buchanan
Application Layer Covert Channel Analysis and ... - Bill Buchanan
- No tags were found...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Z. Kwecka, BSc (Hons) Network Computing, 2006 123else{device.PcapOpen(true,1000);}device.PcapSetFilter("port 80");device.PcapStartCapture();mcStart.Enabled = false;mcStop.Enabled = true;gbAdapter.Enabled = false;if(cbDump.Checked && dumpFile != ""){device.PcapDumpOpen(dumpFile);}else if(cbDump.Checked){MessageBox.Show("Could not open Dump File");}}/// /// Capture Menu Stop Click - stops reading/// /// /// private void mcStop_Click(object sender, System.EventArgs e){cbDump.Checked = false;dumpFile = "";device.PcapStopCapture();device.PcapClose();cbAdapters.SelectedIndex = -1;mcStart.Enabled = false;mcStop.Enabled = false;gbAdapter.Enabled = true;}/// /// OnPacket event h<strong>and</strong>ler - builds collection of "conversations" <strong>and</strong> displays it inlvCon/// /// /// private void device_PcapOnPacketArrival(object sender, Packet aPacket){if(aPacket is TCPPacket){TCPPacket tcp = (TCPPacket)aPacket;if(tcp.DestinationPort == 80 || tcp.SourcePort == 80)//herefor the offline dumph<strong>and</strong>ling{int i = 0;int key = -1;string cntIP;string srvIP;int cntPort;int srvPort;ConTrackingColl connection;if(tcp.DestinationPort == 80){cntIP = tcp.SourceAddress;srvIP = tcp.DestinationAddress;cntPort = tcp.SourcePort;srvPort = tcp.DestinationPort;}else{cntIP = tcp.DestinationAddress;srvIP = tcp.SourceAddress;cntPort = tcp.DestinationPort;srvPort = tcp.SourcePort;}