Develop Reference

How can I extract Link-Layer data from Packet Data in pcap-ng file?

I have a pcap-ng file, and I'd like to extract the source/destination IPs.
According to the winpcap dump file format, the data I'm looking for is in the Packet Data section of the enhanced packet block.
I've been using this library in C# to parse through the pcap-ng file. And while I've been able to successfully get out the Enhanced Packet Block, I'm really not sure how to get into it.
The current Enhanced Packet Block Packet Data comes out as a byte array, using the following method.
private static void extractEnhancedPacketBlock()
{
var myFile = "\\path\\to\\my.pcapng"
using (StreamWriter file = new StreamWriter(myFile))
{
foreach (var enhancedPacketBlock in reader.EnhancedPacketBlocks)
{
byte[] packetData = enhancedPacketBlock.Data;
Console.WriteLine(BitConverter.ToString(packetData));
}
}
}
Which outputs what you would expect, similar to the following:
79-2C-C8-80-A8-65-00-00-BC-C4-2F-65-09-00-42-00-01-5E...etc
A good answer to this could be a few different things like, guidance on where to look to learn more about what I need to do next. A library that already does that that I could use (I've tried a lot of libraries, and none of them seem to go this deep). Or if you already have some code that does this, that would be awesome. I'm also open to moving to Python if necessary.
Additional info.
I know that I can parse the source IP and destination IP out of the Enhanced Packet Blocks, and I know that it will require a hexadecimal to IP conversion, but I do not know where the IP Hex exists in the Enhanced Packet Blocks. I know it's not in the same place every time, but I need to know how to calculate this.

Use https://github.com/chmorgan/packetnet for parsing the packet data
Example:
var packet = Packet.ParsePacket(LinkLayers.Ethernet, enhancedPacketBlock.Data);
var ip = packet.Extract<IPPacket>();

HTML 5 -- C# Websocket response

I'm creating a socket application which is able to receive strings from a websocket within a web page. I have been able to successfully connect the Websocket to my C# program but when ever the webpage sends a string to the program it seems to be encrypted or hashed in some way.
For example if the webpage sends "Test" the program would then output "???9uu?\". I'm obviously missing a step here and I'm not sure what I should searching for to resolve this issue. I'm guessing the string has to be decrypted or put trough a specific function with the TCP key in order to get the actual string?
The code below is the section responsible for receiving the strings from the HTML, (Both "Data" and "MyWriter" output the same string):
while (true)
{
CollectedBytes = new byte[128];
stream.Read(CollectedBytes, 0, CollectedBytes.Length);
string Data = Encoding.ASCII.GetString(CollectedBytes, 0, CollectedBytes.Length);
Output.Speak("Message: " + Data);
StringWriter MyWriter = new StringWriter();
HttpUtility.HtmlDecode(Data, MyWriter);
Output.Speak("Message: " + MyWriter.ToString());
// The word "Test" should output here
// But instead "???9uu?\" is.
}
I'm assuming that I'm missing a simple step but I've looked everywhere and can't seem to find anything to help me!! If anyone can give me guidance on what I should do that would be great :)
Thanks in advance.

Are you trying to decode data manually without using any WebSocket library? If so, you must know that the payload part of WebSocket frames from clients is masked. See RFC 6455, 5.3. Client-to-Server Masking.

How to send to a web-server request for performing js-function under c#?

First of all, english is my foreign language.
Under C# I am trying to send POST http request to a forvo.com (bank with pronounces of words) to get an audio file (stream) with pronunciation of some word. For example, I want to click button1 and listen pronunciation of word "stack" that I got from forvo.com site. For this I have a code:
using (var wb = new WebClient())
{
var data = new NameValueCollection();
data["LANGUAGE_ID"] = "39";
data["WORD"] = "someword"; //this tag doesnt make effect to request
//var response = wb.UploadValues("http://www.forvo.com/search/", "POST", data);
byte[] responseArray = wb.UploadValues("http://www.forvo.com/search/data", "POST", data);
File.WriteAllBytes(Path.GetDirectoryName(Application.ExecutablePath) + "\\fi2le.html", responseArray);
}
With that actions I am trying to get a link to an audio-file. After looking to a file.html I see these strings
<img src="/_presentation/img/ico_play.gif" alt="data pronunciation" id="play_38630" width="23" height="23" />data and others looking similiar.
What can I do with these js-functions or what is it?
I am a newbie in web-programming, and know nothing about js.
and I know forvo.com has its own API for tasks like mine, but I'm trying make it without API.

Looking at what's going on here, the click on the icon triggers the Javascript Play() function.
This function decodes those base 64-encoded values passed to it, and uses them to find the relevant file to play, and whether you are using a browser capable of understanding an audio element (HTML5) in which to play it, or, if not, it creates a Flash player in which to play it.
The second and third arguments to the Play() function are, as mentioned, the base-64 encoded URIs of the files to play. They can be decoded quite simply as follows (example is for a console application):
static void Main()
{
string base64a = "ODk3NTU5NS8zOS84OTc1NTk1XzM5XzE3MjNfMjI4MjAubXAz";
string base64b = "ODk3NTU5NS8zOS84OTc1NTk1XzM5XzE3MjNfMjI4MjAub2dn";
Console.WriteLine(Encoding.Default.GetString(Convert.FromBase64String(base64a)));
Console.WriteLine(Encoding.Default.GetString(Convert.FromBase64String(base64b)));
Console.ReadKey();
}
Should you run this, you'll find that they convert to:
8975595/39/8975595_39_1723_22820.mp3
8975595/39/8975595_39_1723_22820.ogg
There's some logic in the Play function to determine which one to use, but ultimately, I end up playing the following file:
http://audio.forvo.com/mp3/8975595/39/8975595_39_1723_22820.mp3
This work needs to be done in Javascript, as much is dependent upon the browser or device that is making the request, as highlighted above (e.g. HTML5 capability)
I must add, though, that whilst this hopefully explains what is going on, I doubt it would be of any use as a solution; as a paywall is in existence at 500 requests, I'd have thought that they would be on the lookout for multiple requests from the same IP address over a period of time, and would block any such address that was avoiding payment.

Trying to move a file from a python client to a c# server

I am trying to copy a jpg image from a c# server in one PC to a python client in another.
The idea is simply to read the image content:
string text = File.ReadAllText(newPath);
//or
byte[] text = File.ReadAllBytes(newPath);
and to send the text with:
Byte[] sendBytes = text
networkStream.Write(sendBytes, 0, sendBytes.Length);
networkStream.Flush();
and the python client recieves the text and save it into a jpg file right away.
I know it's sound crazy, but it worked! I saw it in another server and wanted to know how did they do it.
I looked for a solution for days, but I still recieve only part of the data all the time (if the file is 7.78 MB, I recieve only 7.74 MB).
I already checked for dupicate posts here, and all I found was transfering files from same language server to the same language client.
I tried using StreamReader and BitConverter, but still I get only part of the image, not all of it.
The python code to save the image that recieved is:
rcvdD = socketPCP.recv(512000000) #I thought that the recv Size is causing to the problem
try:
filename = "image.jpg"
print "NAME:",filename
print "\n\r\n\rNEW FILE RECIEVED!\n\r\n\r"
f=open ('D:/Files/'+filename , 'w')
f.write(rcvdD)
except Exception,e:
print e
Thank You!

I'm not too good at python, but as I remember you should keep recv()-ing appending each chunk in a final buffer until you receive a zero length data or an error, then write to disk what you got in that buffer.

PCAP Library Capabilities (writing new PCAP files)

I am stuck.
I have used PCAP.NET to read .PCAP files and write the packets into a database. Now I can query the database and get packets back that match the constraints. I need a way to write the results to a new .PCAP file.
The problem is that, as far as I can tell, the only way to generate a new PCAP file is via the DumpFile which can only be initialized via a PacketCommunicator that is itself tied to a PacketDevice.
an example can be seen here: http://pcapdotnet.codeplex.com/wikipage?title=Pcap.Net%20Tutorial%20-%20Handling%20offline%20dump%20files&referringTitle=Pcap.Net%20User%20Guide
Well and good, but in this scenario I don't have a device.
Should I roll my own PCAP writer just for this purpose?
Have I missed something obvious?
How can I get these packets into a new PCAP file?
I am convinced that I have overlooked something simple... PCAP is new territory for me and I'm feeling very out of sorts. The Unix folks at work indicate that libpcap which winpcap and therefore pcap.net are based upon provides the ability to write directly to a pcap file. Is the functionality not exposed in the library?
Recommendations are very much appreciated.
Thanks,
Chris
P.S. This is a revision to my original question asked here: .NET writing PCAP files

Is the functionality not exposed in the library?
Which library?
It's exposed in libpcap/WinPcap, but opening the file for output is a bit awkward - you need a pcap_t for a capture device, a pcap_t for a capture file, or a dummy pcap_t for the link-layer header type and snapshot length of the file you're writing if the packets you're writing aren't coming from a live capture or an existing capture file.
I couldn't find any reference documentation for Pcap.NET, just tutorial documentation, but there didn't seem to be anything that let you open a dummy handle - you can open a capture device or a offline capture file, but I didn't see anything about creating a dummy handle from which you can't read packets but that you can use when opening a capture file for writing - so all the functionality available in libpcap/WinPcap is NOT exposed in Pcap.NET, as far as I can tell.

You can create a pcap header and a format, the specification is easy and you don't need a external library apart of the pcap.h.
struct pcap_file_header {
bpf_u_int32 magic;
u_short version_major;
u_short version_minor;
bpf_int32 thiszone; /* gmt to local correction */
bpf_u_int32 sigfigs; /* accuracy of timestamps */
bpf_u_int32 snaplen; /* max length saved portion of each pkt */
bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */
};
So your file first create a header for the pcap file, for example:
struct pcap_file_header pheader;
pheader.magic = 0xA1B2C3D4; // MAGIC NUMBER FOR TCPDUMP
pheader.version_major = PCAP_VERSION_MAJOR;
pheader.version_minor = PCAP_VERSION_MINOR;
pheader.thiszone = 0;
pheader.sigfigs = 0;
pheader.snaplen = 1500;
pheader.linktype = 1;
And for write each packet you need a struct like:
typedef struct {
int32_t t0;
int32_t t1;
int32_t len;
int32_t caplen;
} pcap_header_writeable;
So you will write on the file like:
pcap_header_writeable header;
header.t0 = 0;
header.t1 = 0;
header.len = length;
header.caplen = length;
// write the header on the file
// write the packet on the file after the header

In the Pcap.Net User Guide, the "Handling offline dump files" page has an example using the PacketDumpFile class to write out a dump file. I'm not seeing any Pcap.Net reference manual; to answer this question, the user read the Pcap.Net source code.