Application Layer Covert Channel Analysis and ... - Bill Buchanan

More documents

Recommendations

Info

Z. Kwecka, BSc (Hons) Network Computing, 2006 98/// /// /// private void cbAdapters_SelectedIndexChanged(object sender, System.EventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();mcStop.Enabled = false;}if(cbAdapters.SelectedIndex >-1){if(getNetConnections[cbAdapters.SelectedIndex] is NetworkDevice){mcStart.Enabled = true;NetworkDevice netConn =(NetworkDevice)getNetConnections[cbAdapters.SelectedIndex];device = netConn;device.PcapOnPacketArrival +=new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);}else{MessageBox.Show("Selected adapter \nis not suitable \nfor packet sniffing");cbAdapters.SelectedIndex = -1;}}}/// /// Menu File Exit - Terminates the application/// /// /// private void menuItem3_Click(object sender, System.EventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();}<strong>Application</strong>.Exit();}/// /// lvCon selected h<strong>and</strong>ler - displays packets of the selected conversation inlvPackets/// /// /// private void lvCon_SelectedIndexChanged(object sender, System.EventArgs e){if(lvCon.SelectedItems.Count > 0){ConColl connection = (ConColl) sigSyncArray[lvCon.SelectedIndices[0]];int vnCounter = 0;int lastDataSize = 0;//long lastSeq = 0;long requestedAck = 0;//ArrayList requestedAcks = new ArrayList();lvPackets.Items.Clear();lbHeaders.Items.Clear();headerSyncArray.Clear();for(int i=0;i
Z. Kwecka, BSc (Hons) Network Computing, 2006 99//total lenght - (ethernet + iplenght + tcp header lenght)int dataSize = oPacket.Bytes.Length -(tcpStart+(Convert.ToInt16(oPacket.Bytes[tcpStart+12])& 0xF0)/4);string flags = "";long seq, ack = 0;seq = oPacket.SequenceNumber;ack = oPacket.AcknowledgmentNumber;if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x20)!=0){flags = flags + "(URG)";}if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x10)!=0){flags = flags + "(ACK)";}if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x08)!=0){flags = flags + "(PSH)";}if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x04)!=0){flags = flags + "(RST)";}if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x02)!=0){flags = flags + "(SYN)";}if((Convert.ToInt16(oPacket.Bytes[flags_byte]) & 0x01)!=0){flags = flags + "(FIN)";}//(flagls_byte-9) start of the seq numberListViewItem aItem = new ListViewItem();//if(oPacket.DestinationPort == 80){if(lastDataSize 10){if(rbViewFull.Checked == true){buildHTTP(oPacket);}aItem.ForeColor = Color.FromName("Red");requestedAck = ack;//requestedAcks.Add(ack);}lastDataSize = dataSize;}else if(oPacket.SourcePort == 80 && requestedAck == seq && dataSize > 10){if(rbViewFull.Checked == true){buildHTTP(oPacket);}aItem.ForeColor = Color.FromName("Red");for(int j = 0; j
Page 1 and 2:
Application Layer Covert ChannelAna
Page 3 and 4:
Z. Kwecka, BSc (Hons) Network Compu
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11:
Page 14:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25:
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49: Z. Kwecka, BSc (Hons) Network Compu
Page 56: Z. Kwecka, BSc (Hons) Network Compu
show all

Application Layer Covert Channel Analysis and ... - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?