PcapDotNet / Pcap.Net

.NET wrapper for WinPcap written in C++/CLI and C#, which features almost all WinPcap features and includes a packet interpretation framework.
BSD 3-Clause "New" or "Revised" License
564 stars 167 forks source link

How do I can parse HTTP request? #109

Closed AL3X1 closed 5 years ago

AL3X1 commented 5 years ago

I'm sending request from external application (for example, web browser) and trying to get packets. I successfully get ip address and other needed packet info, but I can't extract HTTP request data.

I'm extracting like this:

var tcp = packet.Ethernet.IpV4.Tcp;                       
var httpBody = tcp.Http.Body;                       
var httpHeader = tcp.Http.Header;

HttpBody and HttpHeader always have null value.

Where am I wrong?

Here is the all code:

           var devices = LivePacketDevice.AllLocalMachine;

            foreach (var captureDevice in devices)
            {
                using (PacketCommunicator communicator = captureDevice.Open(65536, PacketDeviceOpenAttributes.NoCaptureLocal, 1000))
                {
                    using (BerkeleyPacketFilter filter = communicator.CreateFilter("tcp"))
                    {
                        communicator.SetFilter(filter);
                    }

                    communicator.ReceivePackets(0, (packet) =>
                    {
                        IpV4Layer ipv4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                        PayloadLayer ipv4PayloadLayer = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer();
                        var ip = packet.Ethernet.IpV4;

                        try
                        {
                            var tcp = ip.Tcp;

                            // This variables always null. HTTP or HTTPS - doesn't matter.
                            var httpBody = tcp.Http.Body;
                            var httpHeader = tcp.Http.Header;

                            var sourceHostName = Dns.GetHostEntry(IPAddress.Parse(ipv4Layer.Source.ToString())).HostName;
                            var destinationHostName = Dns.GetHostEntry(IPAddress.Parse(ipv4Layer.Destination.ToString())).HostName;

                            Console.WriteLine($"{sourceHostName} - {ip.Source}:{tcp.SourcePort} ----> {destinationHostName} - {ip.Destination}:{tcp.DestinationPort}");
                        }
                        catch (Exception ex)
                        {

                        }
                    });
                }
            }

            Console.ReadLine();
bricknerb commented 5 years ago

Please use the Pcap.Net Q&A Group to ask questions.