Packet Response

[xeron333]

Hello, I've recently started using SharpPcap, which works well, but I'm having a problem because my goal in using SharpPcap was to intercept HTTP requests and trigger a process upon this event. Unfortunately, the arrival of packets corresponding to an HTTP request is sometimes very long, making it difficult to generate the process at the desired time.
I don't know if this can be adjusted. I've attached the code for the filter I set up:
"tcp and (port 80 or port 443)"
Please keep me posted.

[kayoub5]

@xeron333 Is there a specific question you want answered? Without a code sample or very specific questions, there is nothing much I can offer.

[xeron333]

ok
code :

public class
{
private static ILiveDevice deviceC;
public IPAddress WsrcIp;
public void Main3()
{
var ver = Pcap.SharpPcapVersion;
Console.WriteLine("SharpPcap {0}, Example3.BasicCap.cs", ver);
var devices = CaptureDeviceList.Instance;
if (devices.Count < 1)
{
Console.WriteLine("No devices were found on this machine");
return;
}
Console.WriteLine();
Console.WriteLine("The following devices are available on this machine:");
int i = 0;
int choix = 1;
foreach (var dev in devices)
{
Console.WriteLine("{0}) {1} {2}", i, dev.Name, dev.Description);
i++;
}
Console.Write("-- Please choose a device to capture: ");
string i = Console.ReadLine();
deviceC.OnPacketArrival +=
new PacketArrivalEventHandler(device_OnPacketArrival);
int readTimeoutMilliseconds = 1000;
deviceC.Open(mode: DeviceModes.Promiscuous | DeviceModes.DataTransferUdp | DeviceModes.NoCaptureLocal, read_timeout: readTimeoutMilliseconds);
string filter = "tcp and (port 80 or port 443)";
deviceC.Filter = filter;
Console.WriteLine
("-- The following tcpdump filter will be applied: \"{0}\"",
filter);
Console.WriteLine();
filter);
Console.WriteLine("-- Listening on {0} {1}, hit 'Enter' to stop...",
deviceC.Name, deviceC.Description);
deviceC.StartCapture();
Console.ReadLine();
deviceC.StopCapture();
deviceC.Close();
}

private static void device_OnPacketArrival(object sender, PacketCapture e)
var time = e.Header.Timeval.Date;
var len = e.Data.Length;
var data = e.Data;
var rawPacket = e.GetPacket();
var packet = PacketDotNet.Packet.ParsePacket(rawPacket.LinkLayerType, rawPacket.Data);
var tcpPacket = packet.Extract<PacketDotNet.TcpPacket>();
if (tcpPacket != null)
{
var ipPacket = (PacketDotNet.IPPacket)tcpPacket.ParentPacket;
System.Net.IPAddress srcIp = ipPacket.SourceAddress;
System.Net.IPAddress dstIp = ipPacket.DestinationAddress;
int srcPort = tcpPacket.SourcePort;
int dstPort = tcpPacket.DestinationPort;
try
{
IPHostEntry hostSource = Dns.GetHostEntry(srcIp);
IPHostEntry hostDest = Dns.GetHostEntry(dstIp);
string hSrc_ch = (string)hostSource.HostName;
string hDest_ch = (string)hostDest.HostName;
Console.WriteLine("-- " + hSrc_ch);
Console.WriteLine("-- " + hDest_ch);
}
catch (Exception e0)
{
Console.WriteLine("--Error " + e0.Message);
}
}
}
thanks

[kayoub5]

Activate Immediate Mode, that may help with your case

sharppcap/SharpPcap/DeviceConfiguration.cs

Line 29 in 01b7b74

public bool? Immediate { get; set; }

[xeron333]

Thank you. I tried modifying my code with your instructions, but I'm new to C# and I'm not sure if this is the right approach because nothing changes. Here's what I added; the rest is the same:
public class Ex3
{
private static ILiveDevice deviceC;
public IPAddress WsrcIp;
private bool imm = true;
public bool config0
{
get => imm;
set
{
if ((value == true) && (value == false))
{
imm = value;
}
}
}
public void Main3()
{
var ver = Pcap.SharpPcapVersion;
Console.WriteLine("SharpPcap {0}, Example3.BasicCap.cs", ver);
DeviceConfiguration config=new DeviceConfiguration();
config.Immediate = imm;

and to open deviceC :

deviceC.Open(config);

[kayoub5]

where are you observing the delay ?

I don't see in the code any lines related to time measurements

[xeron333]

I had commented on these lines and I put them back but it doesn't change anything...

int readTimeoutMilliseconds = 1000;
deviceC.Open(mode: DeviceModes.Promiscuous | DeviceModes.DataTransferUdp | DeviceModes.NoCaptureLocal, read_timeout: readTimeoutMilliseconds);

And the rest is identical.

deviceC.Open(config);

[xeron333]

Noticed
I think, unless I'm mistaken, that what I wrote is useless: ``

/*private bool _imm = true;
public bool imm
{
get => _imm;
set
{
if ((value == true) && (value == false))
{
_imm = value;
}
else
{
Console.WriteLine("error !");
}
}
}*/

I wrote like this:

DeviceConfiguration config=new DeviceConfiguration();
config.Immediate = true;

But the problem remains...

[xeron333]

Hello, I haven't received a response from you, so I assume there's no solution to my problem? Perhaps SharpPCap isn't suitable for what I want to do, which is create an event for every HTTP(s)request. Please let me know what you think.

[kayoub5]

If you want both HTTP and HTTPS, then the ammout of work that you would have to do in top of SharpPcap would be massive.

[xeron333]

Thanks Okay, but how come it shows me packets corresponding to sites I never visit, and the sites I do visit sometimes get a response, sometimes never!

[chmorgan]

Hi @xeron333 have you checked out https://github.com/dotpcap/packetnet-connections/tree/master/Examples/HttpMonitorExample ?

[xeron333]

thanks chmorgan for your help, for now I'm taking a little time to study your code, I'll come back to you in a while

[xeron333]

Hello, I'm trying to copy your code into the .csproj of my project:

<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net8.0</TargetFramework>
<ReleaseVersion>0.2</ReleaseVersion
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\..\PacketDotNetConnections\PacketDotNetConnections.csproj" />
</ItemGroup>
</Project>

and i have error "Projet 'PacketDotNetConnections.csproj' not found

if change this line :

<ProjectReference Include="..\..\PacketDotNetConnections\PacketDotNetConnections.csproj" />

by this line :

<PackageReference Include="packetnet-connections" Version="1.3.0" />

It works, but shouldn't this project (PacketDotNetConnections.csproj) still be included? And how?

[xeron333]

Hello, finally I managed to include "PacketDotNetConnections.csproj" but nothing changes, I have very little display of my http(s) requests, I attach a screenshot of my solution, so that you see exactly my environment.