I am using the latest version of pcap.net to capture network traffic on my local pc ethernet card. I am using the following code to capture all traffic associated with a specific mac address.
private void bwCapture_DoWork(object sender, DoWorkEventArgs e)
{
capture = true;
IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;
if (allDevices.Count == 0)
{
MessageBox.Show("No interfaces found!");
return;
}
if (capture)
{
// Print the list
for (int i = 0; i != allDevices.Count; ++i)
{
LivePacketDevice device = allDevices[i];
this.BeginInvoke((Action)delegate () { cmbNetworkDevice.Items.Add((i + 1) + ". " + device.Name); });
}
// Take the selected adapter
PacketDevice selectedDevice = allDevices[deviceSelected];
// Open the device
using (PacketCommunicator communicator = selectedDevice.Open(65536, // portion of the packet to capture
PacketDeviceOpenAttributes.Promiscuous, // promiscuous mode
50)) // read timeout
{
this.BeginInvoke((Action)delegate () { rtbCaptured.Text = "Listening on " + selectedDevice.Description + Environment.NewLine; });
// Retrieve the packets
Packet packet;
while (capture)
{
try
{
BerkeleyPacketFilter filter = communicator.CreateFilter("ether host <<MAC ADDRESS>> and tcp port 2000");
communicator.SetFilter(filter);
PacketCommunicatorReceiveResult result = communicator.ReceivePacket(out packet);
switch (result)
{
case PacketCommunicatorReceiveResult.Timeout:
// Timeout elapsed
continue;
case PacketCommunicatorReceiveResult.Ok:
this.BeginInvoke((Action)delegate ()
{
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
if (tcp != null && ip != null)
{
string IPCheck = ip.Source.ToString();
int PortCheck = tcp.DestinationPort;
dgvIncomingPackets.Rows.Add(packet.Timestamp.ToString("MM-dd-yyyy hh:mm:ss"), packet.Length, tcp.SequenceNumber , ip.IpV4.Protocol, ip.Source, tcp.SourcePort, ip.Destination, tcp.DestinationPort);
rtbPacketDeconstruct.Text = WordWrap(ProcessString(packet.BytesSequenceToHexadecimalString()),47);
string convertThis = ProcessString(packet.BytesSequenceToHexadecimalString());
dgvIncomingPackets.FirstDisplayedScrollingRowIndex = dgvIncomingPackets.RowCount - 1;
}
else
{
rtbCaptured.Text += "Error : TCP Null Value" + Environment.NewLine;
}
});
break;
default:
throw new InvalidOperationException("The result " + result + " should never be reached here");
}
}
catch (Exception ex)
{
this.BeginInvoke((Action)delegate ()
{ rtbCaptured.Text += "Exception : " + ex; });
}
}
}
}
}
The code above works however it is not detecting all of the skinny events. When viewing the network traffic with WireShark I am able to see the condition changes in a Cisco 7960 IP Phone including off hook, lamp messages, displaynotification messages.
While these packets are registered in Wireshark on my PC they appear not to be captured using the code above.
My understanding is that skinny uses tcp ports 2000 and 49828 for communication between CUCM and the device. My code does see the TCP ACK and WHOAMI packets.The MAC address being monitored in the Cisco IP Phone. My PC is connected to this device through the built in hub on the device(This isn't the issue because WireShark is showing the events on my PC where my code is not)
What am I missing here. I am a novice to programming and learning on the fly here. (As such I am aware my code isn't the cleanest or well written)
Thanks,
