Application Layer Covert Channel Analysis and ... - Bill Buchanan

More documents

Recommendations

Info

Z. Kwecka, BSc (Hons) Network Computing, 2006 132}else{device.PcapOpen(true,1000);}device.PcapSetFilter("port 80");device.PcapStartCapture();mcStart.Enabled = false;mcStop.Enabled = true;gbAdapter.Enabled = false;if(cbDump.Checked && dumpFile != ""){device.PcapDumpOpen(dumpFile);}else if(cbDump.Checked){MessageBox.Show("Could not open Dump File");}}/// /// Capture Menu Stop Click - stops reading/// /// /// private void mcStop_Click(object sender, System.EventArgs e){device.PcapStopCapture();device.PcapClose();cbAdapters.SelectedIndex = -1;mcStart.Enabled = false;mcStop.Enabled = false;gbAdapter.Enabled = true;}/// /// OnPacket event handler - builds collection of "conversations" and displays it inlvCon/// /// /// private void device_PcapOnPacketArrival(object sender, Packet aPacket){if(aPacket is TCPPacket){TCPPacket tcp = (TCPPacket)aPacket;if(tcp.DestinationPort == 80)//|| tcp.SourcePort == 80)//herefor the offline dumphandling{limit++;if(limit > 100){sw.Close();device.PcapClose();//Application.Exit();}//int i = 0;//int key = -1;string cntIP;string srvIP;int cntPort;int srvPort;//ConTrackingColl connection;if(tcp.DestinationPort == 80){cntIP = tcp.SourceAddress;srvIP = tcp.DestinationAddress;cntPort = tcp.SourcePort;srvPort = tcp.DestinationPort;buildHTTP(tcp);}else{
Z. Kwecka, BSc (Hons) Network Computing, 2006 133cntIP = tcp.DestinationAddress;srvIP = tcp.SourceAddress;cntPort = tcp.DestinationPort;srvPort = tcp.SourcePort;buildHTTP(tcp);}}//end if source or destination port 80}//end of is TCP}/// /// Application closing event handler - ensures reading from the adapter isstoppedprior closure/// /// /// private void HTTPAnalyser_Form1_Closing(object sender,System.ComponentModel.CancelEventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();sw.Close();}}/// /// Shows About messagebox/// /// /// private void mhAbout_Click(object sender, System.EventArgs e){MessageBox.Show("Author: Zbigniew Kwecka\nSupervisor: Dr William Buchanan");}/// /// cbAdapters selected handler - Changes active adapter/// /// /// private void cbAdapters_SelectedIndexChanged(object sender, System.EventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();mcStop.Enabled = false;}if(cbAdapters.SelectedIndex >-1){if(getNetConnections[cbAdapters.SelectedIndex] is NetworkDevice){mcStart.Enabled = true;NetworkDevice netConn =(NetworkDevice)getNetConnections[cbAdapters.SelectedIndex];device = netConn;device.PcapOnPacketArrival +=new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);}else{MessageBox.Show("Selected adapter \nis not suitable \nfor packet sniffing");cbAdapters.SelectedIndex = -1;}}}
Page 1 and 2:
Application Layer Covert ChannelAna
Page 3 and 4:
Z. Kwecka, BSc (Hons) Network Compu
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11:
Page 14:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25:
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56:
Page 60 and 61:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82: Z. Kwecka, BSc (Hons) Network Compu
Page 113: Z. Kwecka, BSc (Hons) Network Compu
Page 138: Z. Kwecka, BSc (Hons) Network Compu
show all

Application Layer Covert Channel Analysis and ... - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?