Open LiamKarlMitchell opened 9 years ago
function parse_pcap_tcp(buffer) {
if (buffer.length <= 0x35) {
return null;
}
// Is it TCP Version 4?
if (buffer.readUInt8(14) != 0x45) {
return null;
}
// Read Source IP
var sourceIP = buffer.readUInt8(0x1A).toString() + '.' +
buffer.readUInt8(0x1B).toString() + '.' +
buffer.readUInt8(0x1C).toString() + '.' +
buffer.readUInt8(0x1D).toString();
var destinationIP = buffer.readUInt8(0x1E).toString() + '.' +
buffer.readUInt8(0x1F).toString() + '.' +
buffer.readUInt8(0x20).toString() + '.' +
buffer.readUInt8(0x21).toString();
var sourcePort = buffer.readUInt16BE(0x22);
var destinationPort = buffer.readUInt16BE(0x24);
var data = buffer.slice(0x36);
return {
sourceIP: sourceIP,
destinationIP: destinationIP,
sourcePort: sourcePort,
destinationPort: destinationPort,
data: data
}
}
Frame, IP, TCP To get the source/destination and ports.
I guess I can write it if needed but thought it worth asking.