Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 96{int i = 0;int key = -1;string cntIP;string srvIP;int cntPort;int srvPort;if(tcp.DestinationPort == 80){cntIP = tcp.SourceAddress;srvIP = tcp.DestinationAddress;cntPort = tcp.SourcePort;srvPort = tcp.DestinationPort;}else{cntIP = tcp.DestinationAddress;srvIP = tcp.SourceAddress;cntPort = tcp.DestinationPort;srvPort = tcp.SourcePort;}lock(sigSyncArray.SyncRoot){System.Collections.IEnumerator myEnumerator = sigSyncArray.GetEnumerator();while ( myEnumerator.MoveNext() ){ConColl connection = (ConColl)myEnumerator.Current;if( connection.CheckSignature(cntIP,srvIP,cntPort,srvPort)){connection.Add(aPacket);key = i;break;}i++;}//end while}//end lockif (key == (-1) ){ConColl connection = new ConColl(cntIP,srvIP,cntPort,srvPort);connection.Add(aPacket);sigSyncArray.Add(connection);ListViewItem aItem = new ListViewItem();key = sigSyncArray.Count-1;aItem.SubItems[0].Text = System.Convert.ToString(key.ToString());aItem.SubItems.Add(System.Convert.ToString(cntIP));aItem.SubItems.Add(System.Convert.ToString(srvIP));aItem.SubItems.Add(System.Convert.ToString(cntPort));aItem.SubItems.Add(System.Convert.ToString(srvPort));lvCon.Items.Add(aItem);}//end if connection array does not existif(device.PcapDumpOpened){device.PcapDump(aPacket);}}//end if source or destination port 80}//end of is TCP}/// /// lvPackets Selection - displays packet HTTP level data in lbHeaders/// /// /// private void lvPackets_SelectedIndexChanged(object sender, System.EventArgs e){if(lvPackets.SelectedItems.Count > 0 && lvPackets.SelectedItems.Count > 0){if(rbViewPacket.Checked == true){ConColl connection = (ConColl) sigSyncArray[lvCon.SelectedIndices[0]];TCPPacket oPacket = (TCPPacket)connection.GetPacket(Convert.ToInt16(lvPackets.Items[lvPackets.SelectedIndices[0]].Text));