Application Layer Covert Channel Analysis and ... - Bill Buchanan

More documents

Recommendations

Info

Z. Kwecka, BSc (Hons) Network Computing, 2006 96{int i = 0;int key = -1;string cntIP;string srvIP;int cntPort;int srvPort;if(tcp.DestinationPort == 80){cntIP = tcp.SourceAddress;srvIP = tcp.DestinationAddress;cntPort = tcp.SourcePort;srvPort = tcp.DestinationPort;}else{cntIP = tcp.DestinationAddress;srvIP = tcp.SourceAddress;cntPort = tcp.DestinationPort;srvPort = tcp.SourcePort;}lock(sigSyncArray.SyncRoot){System.Collections.IEnumerator myEnumerator = sigSyncArray.GetEnumerator();while ( myEnumerator.MoveNext() ){ConColl connection = (ConColl)myEnumerator.Current;if( connection.CheckSignature(cntIP,srvIP,cntPort,srvPort)){connection.Add(aPacket);key = i;break;}i++;}//end while}//end lockif (key == (-1) ){ConColl connection = new ConColl(cntIP,srvIP,cntPort,srvPort);connection.Add(aPacket);sigSyncArray.Add(connection);ListViewItem aItem = new ListViewItem();key = sigSyncArray.Count-1;aItem.SubItems[0].Text = System.Convert.ToString(key.ToString());aItem.SubItems.Add(System.Convert.ToString(cntIP));aItem.SubItems.Add(System.Convert.ToString(srvIP));aItem.SubItems.Add(System.Convert.ToString(cntPort));aItem.SubItems.Add(System.Convert.ToString(srvPort));lvCon.Items.Add(aItem);}//end if connection array does not existif(device.PcapDumpOpened){device.PcapDump(aPacket);}}//end if source or destination port 80}//end of is TCP}/// /// lvPackets Selection - displays packet HTTP level data in lbHeaders/// /// /// private void lvPackets_SelectedIndexChanged(object sender, System.EventArgs e){if(lvPackets.SelectedItems.Count > 0 && lvPackets.SelectedItems.Count > 0){if(rbViewPacket.Checked == true){ConColl connection = (ConColl) sigSyncArray[lvCon.SelectedIndices[0]];TCPPacket oPacket = (TCPPacket)connection.GetPacket(Convert.ToInt16(lvPackets.Items[lvPackets.SelectedIndices[0]].Text));
Z. Kwecka, BSc (Hons) Network Computing, 2006 97lbHeaders.Items.Clear();string headers = "";int tcpStart = 14 + 4*(Convert.ToInt16(oPacket.Bytes[14])& 0x0F);//ipstart +header lenghtint tcpLenght = (Convert.ToInt16(oPacket.Bytes[tcpStart+12])& 0xF0)/4;int ipTotal =(Convert.ToInt16(oPacket.Bytes[16]))*256+(Convert.ToInt16(oPacket.Bytes[17]));if( tcpStart+tcpLenght
Page 1 and 2:
Application Layer Covert ChannelAna
Page 3 and 4:
Z. Kwecka, BSc (Hons) Network Compu
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11:
Page 14:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25:
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47: Z. Kwecka, BSc (Hons) Network Compu
Page 56: Z. Kwecka, BSc (Hons) Network Compu
show all

Application Layer Covert Channel Analysis and ... - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?