TCP Session Reconstruction Tool

Saar Yahalom

Rate me:

4.65/5 (17 votes)

21 Sep 2007CPOL6 min read

165.9K

8.2K

A TCP session reconstruction tool for C#.

tcpreconbin.zip
- managedLibnids.dll
- Tamir.IPLib.SharpPcap.dll
- TcpRecon.exe
tcprecon.zip
- TcpRecon
  - TcpRecon.sln
  - TcpRecon
    - bin
      - Debug
        
        managedLibnids.dll
        
        Tamir.IPLib.SharpPcap.dll
      - Release
        
        managedLibnids.dll
        
        Tamir.IPLib.SharpPcap.dll
        
        TcpRecon.exe
    - managedLibnids.dll
    - obj
      - Debug
        
        TempPE
      - Release
        
        TempPE
    - Program.cs
    - Tamir.IPLib.SharpPcap.dll
    - TcpRecon.cs
    - TcpRecon.csproj
    - TcpRecon.csproj.user
winpcap41.zip
- Winpcap
  - WpdPack
    - docs
      - html
        
        annotated.html
        
        daemon_8h.html
        
        daemon_8h-source.html
        
        deprecated.html
        
        doxygen.png
        
        doxygen__groups_8txt.html
        
        dump.gif
        
        encoding.gif
        
        fileconf_8h.html
        
        fileconf_8h-source.html
        
        files.html
        
        ftv2blank.png
        
        ftv2doc.png
        
        ftv2folderclosed.png
        
        ftv2folderopen.png
        
        ftv2lastnode.png
        
        ftv2link.png
        
        ftv2mlastnode.png
        
        ftv2mnode.png
        
        ftv2node.png
        
        ftv2plastnode.png
        
        ftv2pnode.png
        
        ftv2vertline.png
        
        funcs_2pcap_8h.html
        
        funcs_2pcap_8h-source.html
        
        functions.html
        
        functions_vars.html
        
        globals.html
        
        globals_0x62.html
        
        globals_0x63.html
        
        globals_0x64.html
        
        globals_0x65.html
        
        globals_0x66.html
        
        globals_0x67.html
        
        globals_0x68.html
        
        globals_0x69.html
        
        globals_0x6a.html
        
        globals_0x6b.html
        
        globals_0x6d.html
        
        globals_0x6e.html
        
        globals_0x6f.html
        
        globals_0x70.html
        
        globals_0x72.html
        
        globals_0x73.html
        
        globals_0x74.html
        
        globals_0x75.html
        
        globals_defs.html
        
        globals_enum.html
        
        globals_eval.html
        
        globals_func.html
        
        globals_type.html
        
        globals_vars.html
        
        group__compilation.html
        
        group__internals.html
        
        group__language.html
        
        group__NPF.html
        
        group__NPF__code.html
        
        group__NPF__include.html
        
        group__packetapi.html
        
        group__remote.html
        
        group__remote__auth__methods.html
        
        group__remote__open__flags.html
        
        group__remote__pri__func.html
        
        group__remote__pri__struct.html
        
        group__remote__samp__methods.html
        
        group__remote__source__ID.html
        
        group__remote__source__string.html
        
        group__remote__struct.html
        
        group__remotefunc.html
        
        group__wpcap.html
        
        group__wpcap__def.html
        
        group__wpcap__tut.html
        
        group__wpcap__tut1.html
        
        group__wpcap__tut2.html
        
        group__wpcap__tut3.html
        
        group__wpcap__tut4.html
        
        group__wpcap__tut5.html
        
        group__wpcap__tut6.html
        
        group__wpcap__tut7.html
        
        group__wpcap__tut8.html
        
        group__wpcap__tut9.html
        
        group__wpcapfunc.html
        
        group__wpcapsamps.html
        
        incs_2pcap_8h.html
        
        incs_2pcap_8h-source.html
        
        index.hhc
        
        index.hhk
        
        index.hhp
        
        index.html
        
        internals-arch.gif
        
        jitter_8h.html
        
        jitter_8h-source.html
        
        main.html
        
        main_8txt.html
        
        modules.html
        
        npf-dump.gif
        
        npf-ndis.gif
        
        npf-npf.gif
        
        Packet_8h.html
        
        Packet_8h-source.html
        
        pages.html
        
        pcap-remote_8h.html
        
        pcap-remote_8h-source.html
        
        remote-ext_8h.html
        
        remote-ext_8h-source.html
        
        rpcapd_8h.html
        
        rpcapd_8h-source.html
        
        stats.gif
        
        stats_wpcap.gif
        
        struct____CPU__Private__Data.html
        
        struct__DEVICE__EXTENSION.html
        
        struct__INTERNAL__REQUEST.html
        
        struct__OPEN__INSTANCE.html
        
        struct__PACKET__RESERVED.html
        
        structactive__pars.html
        
        structactivehosts.html
        
        structbinary__stream.html
        
        structdaemon__slpars.html
        
        structJIT__BPF__Filter.html
        
        structpacket__file__header.html
        
        structPacketHeader.html
        
        structpcap__addr.html
        
        structpcap__file__header.html
        
        structpcap__if.html
        
        structpcap__pkthdr.html
        
        structpcap__rmtauth.html
        
        structpcap__samp.html
        
        structpcap__send__queue.html
        
        structpcap__stat.html
        
        structrpcap__auth.html
        
        structrpcap__filter.html
        
        structrpcap__filterbpf__insn.html
        
        structrpcap__findalldevs__if.html
        
        structrpcap__findalldevs__ifaddr.html
        
        structrpcap__header.html
        
        structrpcap__openreply.html
        
        structrpcap__pkthdr.html
        
        structrpcap__sampling.html
        
        structrpcap__startcapreply.html
        
        structrpcap__startcapreq.html
        
        structrpcap__stats.html
        
        structsf__pkthdr.html
        
        style.css
        
        tab_b.gif
        
        tab_l.gif
        
        tab_r.gif
        
        tabs.css
        
        tree.html
        
        utils_8h.html
        
        utils_8h-source.html
        
        Win32-Extensions_8h.html
        
        Win32-Extensions_8h-source.html
        
        win32-svc_8h.html
        
        win32-svc_8h-source.html
        
        winpcap.gif
        
        winpcap_small.gif
        
        wpcap__remote_8htm.html
        
        wpcap__remote_8htm-source.html
        
        wpcap__tut_8txt.html
        
        wpcap__tut1_8txt.html
        
        wpcap__tut2_8txt.html
        
        wpcap__tut3_8txt.html
        
        wpcap__tut4_8txt.html
        
        wpcap__tut5_8txt.html
        
        wpcap__tut6_8txt.html
        
        wpcap__tut7_8txt.html
        
        wpcap__tut8_8txt.html
        
        wpcap__tut9_8txt.html
      - WinPcap_docs.html
    - Examples-pcap
      - basic_dump
        
        basic_dump.c
        
        basic_dump.dsp
        
        basic_dump.dsw
        
        GNUmakefile
      - basic_dump_ex
        
        basic_dump_ex.c
        
        basic_dump_ex.dsp
        
        basic_dump_ex.dsw
        
        GNUmakefile
      - GNUmakefile
      - iflist
        
        GNUmakefile
        
        iflist.c
        
        iflist.dsp
        
        iflist.dsw
      - MakeaAll.dsw
      - pcap_filter
        
        GNUmakefile
        
        Makefile.unix
        
        pcap_filter.c
        
        pcap_filter.dsp
        
        pcap_filter.dsw
      - pktdump_ex
        
        GNUmakefile
        
        pktdump_ex.c
        
        pktdump_ex.dsp
        
        pktdump_ex.dsw
      - readfile
        
        GNUmakefile
        
        readfile.c
        
        readfile.dsp
        
        readfile.dsw
      - readfile_ex
        
        GNUmakefile
        
        readfile_ex.c
        
        readfile_ex.dsp
        
        readfile_ex.dsw
      - savedump
        
        GNUmakefile
        
        savedump.c
        
        savedump.dsp
        
        savedump.dsw
      - sendpack
        
        GNUmakefile
        
        sendpack.c
        
        sendpack.dsp
        
        sendpack.dsw
      - UDPdump
        
        GNUmakefile
        
        udpdump.c
        
        UDPdump.dsp
        
        UDPdump.dsw
    - Examples-remote
      - iflist
        
        iflist.c
        
        iflist.dsp
        
        iflist.dsw
      - MakeaAll.dsw
      - misc
        
        basic_dump.c
        
        basic_dump.dsp
        
        basic_dump_ex.c
        
        basic_dump_ex.dsp
        
        MakeaAll.dsw
        
        readfile.c
        
        readfile.dsp
        
        readfile_ex.c
        
        readfile_ex.dsp
        
        savedump.c
        
        savedump.dsp
        
        sendpack.c
        
        sendpack.dsp
      - PacketDriver
        
        GetMacAddress
        
        GetMacAddress.c
        
        GetMacAddress.dsp
        
        readme.txt
        
        TestPacketCapture
        
        TestPacketCapture.c
        
        TestPacketCapture.dsp
        
        TestPacketSend
        
        TestPacketSend.c
        
        TestPacketSend.dsp
      - pcap_filter
        
        pcap_filter.c
        
        pcap_filter.dsp
        
        pcap_filter.dsw
      - pktdump_ex
        
        pktdump_ex.c
        
        pktdump_ex.dsp
        
        pktdump_ex.dsw
      - sendcap
        
        sencap.dsw
        
        sendcap.c
        
        sendcap.dsp
      - smp_1
        
        smp_1.c
        
        smp_1.dsp
        
        smp_1.dsw
      - tcptop
        
        tcptop.c
        
        tcptop.dsp
        
        tcptop.dsw
      - UDPdump
        
        udpdump.c
        
        UDPdump.dsp
        
        UDPdump.dsw
      - UserLevelBridge
        
        UserBridge.c
        
        UserBridge.dsp
        
        UserBridge.dsw
    - Include
    - Lib
      - libpacket.a
      - libwpcap.a
      - Packet.lib
      - wpcap.lib
libnids-119_with_managedlibnids.zip
- Libnids-1.19
  - CHANGES
  - config.guess
  - config.sub
  - configure
  - configure.in
  - COPYING
  - CREDITS
  - doc
    - API.html
    - API.txt
    - bugtraq_post
    - LINUX
    - NEW_LIBPCAP
    - PATCH
    - PERFORMANCE
    - TESTS
  - install-sh
  - Makefile.in
  - managedLibnids
    - app.ico
    - app.rc
    - AssemblyInfo.cpp
    - Debug
      - app.res
      - BuildLog.htm
      - managedLibnids.dll.intermediate.manifest
      - mt.dep
      - vc80.idb
    - managedLibnids.cpp
    - managedLibnids.h
    - managedLibnids.vcproj
    - managedLibnids.vcproj.YOUR-E0203EEC26.Owner.user
    - ReadMe.txt
    - Release
      - app.res
      - BuildLog.htm
      - managedLibnids.dll.intermediate.manifest
      - mt.dep
      - vc80.idb
    - resource.h
    - Stdafx.cpp
    - Stdafx.h
  - MISC
  - mkinstalldirs
  - README
  - samples
    - Makefile.in
    - nids_next.c
    - overflows.c
    - printall.c
    - sniff.c
  - src
    - allpromisc.c
    - checksum.c
    - checksum.h
    - config.h.in
    - hash.c
    - hash.h
    - ip_fragment.c
    - ip_fragment.h
    - ip_options.c
    - killtcp.c
    - libnids.3
    - libnids.3.mdoc
    - libnids.c
    - Makefile.in
    - scan.c
    - scan.h
    - tcp.c
    - tcp.h
    - util.c
    - util.h
  - Win32_Readme.txt
  - WIN32-Code
    - getopt.c
    - misc.c
    - random.c
  - WIN32-Includes
    - config.h
    - getopt.h
    - GNUC.H
    - NET
      - Bpf.h
    - NETINET
      - IF_ETHER.H
      - In.h
      - IN_SYSTM.H
      - IP.H
      - IP_ICMP.H
      - IP_VAR.H
      - TCP.H
      - TCP_VAR.H
      - TCPIP.H
      - UDP.H
      - UDP_VAR.H
    - nids.h
    - pcap.h
    - pcap-namedb.h
    - UNISTD.H
  - WIN32-Libraries
    - libnids.lib
  - WIN32-PRJ
    - Debug
      - BuildLog.htm
      - libnids.lib
      - managedLibnids.dll
      - managedLibnids.ilk
      - mt.dep
      - printall.exe
      - printall.exe.embed.manifest
      - printall.exe.embed.manifest.res
      - printall.exe.intermediate.manifest
      - printall.ilk
      - vc80.idb
    - libnids.dsp
    - libnids.dsw
    - libnids.sln
    - libnids.vcproj
    - libnids.vcproj.YOUR-E0203EEC26.Owner.user
    - overflows.dsp
    - overflows.vcproj
    - overflows.vcproj.YOUR-E0203EEC26.Owner.user
    - overflows___Win32_Debug
      - BuildLog.htm
      - overflows.exe.embed.manifest
      - overflows.exe.embed.manifest.res
      - vc80.idb
    - printall.dsp
    - printall.vcproj
    - printall.vcproj.YOUR-E0203EEC26.Owner.user
    - Release
      - BuildLog.htm
      - managedLibnids.dll
      - vc80.idb
    - sniff.dsp
    - sniff.vcproj
    - sniff.vcproj.YOUR-E0203EEC26.Owner.user
    - sniff___Win32_Debug
      - BuildLog.htm
      - sniff.exe.embed.manifest
      - sniff.exe.embed.manifest.res
      - vc80.idb

/*
  Copyright (c) 1999 Rafal Wojtczuk <nergal@icm.edu.pl>. All rights reserved.
  See the file COPYING for license details.
*/

#ifndef _NIDS_IP_FRAGMENT_H
#define _NIDS_IP_FRAGMENT_H

#define IPF_NOTF 1
#define IPF_NEW  2
#define IPF_ISF  3

int ip_frag_init(int);
int ip_defrag_stub(struct ip *, struct ip **);

#endif /* _NIDS_IP_FRAGMENT_H */

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Written By

Saar Yahalom

Software Developer Microsoft

Israel

Saar, has been programing since 1997. He enjoys taking things a part and designing simple solutions to complex problems. Currently, works for Microsoft writing in a variety of languages and flavors. During the last year he is taking a closer look into mobile and web development.

TCP Session Reconstruction Tool

License

Comments and Discussions