Question

我正在使用最新版本的pcap.net来捕获我本地pc以太网卡上的网络流量。我使用以下代码捕获与特定mac地址关联的所有流量。

private void bwCapture_DoWork(object sender, DoWorkEventArgs e)
        {
                capture = true;
                IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

                if (allDevices.Count == 0)
                {
                    MessageBox.Show("No interfaces found!");
                    return;
                }

                if (capture)
                {
                    // Print the list
                    for (int i = 0; i != allDevices.Count; ++i)
                    {
                        LivePacketDevice device = allDevices[i];
                        this.BeginInvoke((Action)delegate () { cmbNetworkDevice.Items.Add((i + 1) + ". " + device.Name); });
                    }

                    // Take the selected adapter
                    PacketDevice selectedDevice = allDevices[deviceSelected];

                    // Open the device
                    using (PacketCommunicator communicator = selectedDevice.Open(65536, // portion of the packet to capture
                                            PacketDeviceOpenAttributes.Promiscuous, // promiscuous mode
                                            50))                                  // read timeout
                    {
                        this.BeginInvoke((Action)delegate () { rtbCaptured.Text = "Listening on " + selectedDevice.Description + Environment.NewLine; });
                        // Retrieve the packets
                        Packet packet;
                    while (capture)
                    {
                        try
                        {
                            BerkeleyPacketFilter filter = communicator.CreateFilter("ether host <<MAC ADDRESS>> and tcp port 2000");
                            communicator.SetFilter(filter);
                            PacketCommunicatorReceiveResult result = communicator.ReceivePacket(out packet);

                            switch (result)
                            {
                                case PacketCommunicatorReceiveResult.Timeout:
                                    // Timeout elapsed
                                    continue;
                                case PacketCommunicatorReceiveResult.Ok:
                                    this.BeginInvoke((Action)delegate ()
                                    {
                                        IpV4Datagram ip = packet.Ethernet.IpV4;
                                        TcpDatagram tcp = ip.Tcp;
                                        if (tcp != null && ip != null)
                                        {
                                            string IPCheck = ip.Source.ToString();
                                            int PortCheck = tcp.DestinationPort;
                                            dgvIncomingPackets.Rows.Add(packet.Timestamp.ToString("MM-dd-yyyy hh:mm:ss"), packet.Length, tcp.SequenceNumber , ip.IpV4.Protocol, ip.Source, tcp.SourcePort, ip.Destination, tcp.DestinationPort);
                                            rtbPacketDeconstruct.Text = WordWrap(ProcessString(packet.BytesSequenceToHexadecimalString()),47);
                                            string convertThis = ProcessString(packet.BytesSequenceToHexadecimalString());
                                                                                            dgvIncomingPackets.FirstDisplayedScrollingRowIndex = dgvIncomingPackets.RowCount - 1;
                                        }
                                        else
                                        {
                                            rtbCaptured.Text += "Error : TCP Null Value" + Environment.NewLine;
                                        }
                                    });
                                    break;
                                default:
                                    throw new InvalidOperationException("The result " + result + " should never be reached here");
                            }
                        }
                        catch (Exception ex)
                        {
                            this.BeginInvoke((Action)delegate ()
                            { rtbCaptured.Text += "Exception : " + ex; });
                        }
                    }
                    }
                }
        }

上面的代码可以正常工作但它没有检测到所有的瘦事件。使用WireShark查看网络流量时，我能够看到Cisco 7960 IP电话中的状况变化，包括摘机，灯泡消息，显示通知消息。

虽然这些数据包在我的PC上的Wireshark中注册，但似乎没有使用上面的代码捕获它们。

我的理解是skinny使用tcp端口2000和49828进行CUCM和设备之间的通信。我的代码确实看到了TCP ACK和WHOAMI数据包。思科IP电话中监控的MAC地址。我的PC通过设备上的内置集线器连接到此设备（这不是问题，因为WireShark正在我的PC上显示我的代码所没有的事件）

我在这里缺少什么。我是这里的编程和学习的新手。（因此我知道我的代码不是最干净或写得最好的）

谢谢，

在C＃Winform应用程序中使用pcap.net查看所有瘦的流量问题

0 个答案: