at.jku.fim.rubanetra.protocol.activity.tcp

Class TcpActivity

java.lang.Object

java.util.EventObject

at.jku.fim.rubanetra.protocol.activity.AbstractActivity

at.jku.fim.rubanetra.protocol.activity.AbstractReplaceableActivity

at.jku.fim.rubanetra.protocol.activity.tcp.TcpActivity

All Implemented Interfaces:

CsvRecordOutputWriter, Activity, ReplaceableActivity, Serializable

public class TcpActivity
extends AbstractReplaceableActivity

Encapsulates a vast amount of TCP flags/options/values and derived information, however, some fields have not yet been implemented by the Kraken TCP-Decoder and/or the JNetPcap-decoder. In these cases either a value of -1 or null is returned instead, e.g. for relative seq/ack numbers or the client/server state or the traffic direction. Two constructors are provided, one is intended for use by decoded Kraken TCP packets TcpPacket the other one for the JNetPcap equivalent Tcp. However, independent of the used constructor the JNetPcap representation will always be made available if possible. Instances of this class will not be included in the final output, AbstractActivity.setExcludedFromOutput(boolean) should be called appropriately to override this behaviour.

See Also:

Serialized Form

Field Summary

Fields inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractActivity

PROPERTY_ADD_FRAME_NUMBERS, PROPERTY_NEW_END_INSTANT, PROPERTY_NEW_START_INSTANT

Fields inherited from class java.util.EventObject

source

Constructor Summary

Constructors

Constructor and Description
TcpActivity(PcapActivity source, org.jnetpcap.protocol.tcpip.Tcp tcp, IpActivity ip)
TcpActivity(PcapActivity source, org.krakenapps.pcap.decoder.tcp.TcpPacket tcpPacket, org.krakenapps.pcap.decoder.tcp.TcpSession tcpSession) Constructs a new Tcp activity using the decoded Kraken data.

Method Summary

Modifier and Type	Method and Description
boolean	equals(Object obj) ENHANCEMENT: Crude check based on the source activity should be replaced by a more detailed comparison since the decoders may not be deterministic.
long	getAcknowledgeNumber()
int	getChecksum()
org.krakenapps.pcap.decoder.tcp.TcpState	getClientState()
int	getControlBits()
int	getDataOffset()
InetAddress	getDestinationAddress()
String	getDestinationAddressAsString() An address that can be interpreted as the destination address for this activity.
int	getDestinationPort()
InetSocketAddress	getDestinationSocketAddress()
org.krakenapps.pcap.decoder.tcp.TcpDirection	getDirection()
byte[]	getOptions()
byte[]	getPadding()
PcapActivity	getPcapActivity()
int	getRelativeAcknowledgeNumber()
int	getRelativeSequenceNumber()
long	getSequenceNumber()
org.krakenapps.pcap.decoder.tcp.TcpState	getServerState()
InetAddress	getSourceAddress()
String	getSourceAddressAsString() An address that can be interpreted as the source address for this activity.
int	getSourcePort()
InetSocketAddress	getSourceSocketAddress()
org.jnetpcap.protocol.tcpip.Tcp	getTcp()
int	getTcpLength()
int	getUrgentPointer()
int	getWindowSize()
boolean	isAck()
boolean	isFin()
boolean	isPsh()
boolean	isRst()
boolean	isSyn()
boolean	isUrg()
String	payloadHexFormattedDump()
String	payloadHexString()
String	payloadString()
String	toString()

Methods inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractReplaceableActivity

isReplaced, replaceActivity, setReplaced

Methods inherited from class at.jku.fim.rubanetra.protocol.activity.AbstractActivity

addOptionalField, addPropertyChangeListener, addPropertyChangeListener, extendActivity, getActivityType, getCompoundFrameNumbers, getDescription, getEndInstant, getEndTimestamp, getOptionalFields, getStartInstant, getStartTimestamp, isExcludedFromOutput, removePropertyChangeListener, removePropertyChangeListener, removeReplacedActivity, setDescription, setDestinationAddress, setEndInstant, setExcludedFromOutput, setSourceAddress, setStartInstant, writeCsvRecord

Methods inherited from class java.util.EventObject

getSource

Methods inherited from class java.lang.Object

clone, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface at.jku.fim.rubanetra.protocol.activity.Activity

addPropertyChangeListener, addPropertyChangeListener, getActivityType, getCompoundFrameNumbers, getDescription, getEndInstant, getEndTimestamp, getOptionalFields, getStartInstant, getStartTimestamp, isExcludedFromOutput, removePropertyChangeListener, removePropertyChangeListener, setExcludedFromOutput

Constructor Detail

TcpActivity

public TcpActivity(PcapActivity source,
                   org.krakenapps.pcap.decoder.tcp.TcpPacket tcpPacket,
                   org.krakenapps.pcap.decoder.tcp.TcpSession tcpSession)

Constructs a new Tcp activity using the decoded Kraken data. The source pcap activity on which this TCP-activity occurred will be replaced.

Parameters:

source - the final pacp activity that led to a successful decode by the Kraken TCP decoder.

tcpPacket - the decoded TCP packet data

tcpSession - the maintained TCP session information (client & server state)

TcpActivity

public TcpActivity(PcapActivity source,
                   org.jnetpcap.protocol.tcpip.Tcp tcp,
                   IpActivity ip)

Method Detail

getSourcePort

public int getSourcePort()

Returns:

the L4 source address information

See Also:

getSourceSocketAddress()

getDestinationPort

public int getDestinationPort()

Returns:

the L4 destination address information

See Also:

getDestinationSocketAddress()

getSourceAddress

public InetAddress getSourceAddress()

Returns:

the L3 source address information

See Also:

getSourceSocketAddress()

getSourceSocketAddress

public InetSocketAddress getSourceSocketAddress()

Returns:

the L3/L4 source address information

getDestinationAddress

public InetAddress getDestinationAddress()

Returns:

the L3 destination address information

See Also:

getDestinationSocketAddress()

getDestinationSocketAddress

public InetSocketAddress getDestinationSocketAddress()

Returns:

the L3/L4 destination address information

getSequenceNumber

public long getSequenceNumber()

Returns:

the decoded sequence number

getAcknowledgeNumber

public long getAcknowledgeNumber()

Returns:

the decoded ACK number

getDataOffset

public int getDataOffset()

Returns:

the decoded data offset

getControlBits

public int getControlBits()

Returns:

the control flags

getWindowSize

public int getWindowSize()

Returns:

the parsed window size

getChecksum

public int getChecksum()

Returns:

the parsed checksum

getUrgentPointer

public int getUrgentPointer()

Returns:

the parsed urgent pointer value

getTcpLength

public int getTcpLength()

Returns:

the content of the TCP length field

getOptions

public byte[] getOptions()

Returns:

the options as array or null (if the JNetPcap constructor was used)

getPadding

public byte[] getPadding()

Returns:

the padding bytes or null (if the JNetPcap constructor was used)

isSyn

public boolean isSyn()

Returns:

true, if the syn flag is set

isAck

public boolean isAck()

Returns:

true, if the ack flag is set

isPsh

public boolean isPsh()

Returns:

true, if the psh flag is set

isFin

public boolean isFin()

Returns:

true, if the fin flag is set

isRst

public boolean isRst()

Returns:

true, if the rst flag is set

isUrg

public boolean isUrg()

Returns:

true, if the urg flag is set

getDirection

public org.krakenapps.pcap.decoder.tcp.TcpDirection getDirection()

Returns:

the direction of this activity, e.g. client->server. may be null if the JNetPcap constructor was used.

getClientState

public org.krakenapps.pcap.decoder.tcp.TcpState getClientState()

Returns:

the client state. may be null if the JNetPcap constructor was used.

getServerState

public org.krakenapps.pcap.decoder.tcp.TcpState getServerState()

Returns:

the server state. may be null if the JNetPcap constructor was used.

getPcapActivity

public PcapActivity getPcapActivity()

Returns:

the source on which this activity occurred or the final PcapActivity that led to the fully decoded packet.

getRelativeSequenceNumber

public int getRelativeSequenceNumber()

Returns:

the relative sequence number (calculated by the Kraken decoder, may be -1 if the JNetPcap constructor was used)

getRelativeAcknowledgeNumber

public int getRelativeAcknowledgeNumber()

Returns:

the relative ack number (calculated by the Kraken decoder, may be -1 if the JNetPcap constructor was used)

getTcp

public org.jnetpcap.protocol.tcpip.Tcp getTcp()

Returns:

the JNetPcap representation of a decoded TCP packet or null, if not available

payloadString

public String payloadString()

Returns:

the payload as a String, or null if the payload is not available or empty

payloadHexFormattedDump

public String payloadHexFormattedDump()

Returns:

a formatted Hex dump of the payload or null if the payload is not available or empty

See Also:

FormatUtils.hexdump(byte[])

payloadHexString

public String payloadHexString()

Returns:

a Hex dump of the payload or null if the payload is not available or empty

See Also:

FormatUtils.hexdump(byte[])

equals

public boolean equals(Object obj)

ENHANCEMENT: Crude check based on the source activity should be replaced by a more detailed comparison since the decoders may not be deterministic.

Overrides:

equals in class Object

getSourceAddressAsString

public String getSourceAddressAsString()

Description copied from interface: Activity

An address that can be interpreted as the source address for this activity. Usually this address should correspond to a human readable value. Because different protocols may be defining different address formats and types, the returned value is highly dependant on the actual implementation and may be empty or null if no source address exists at all.

Specified by:

getSourceAddressAsString in interface Activity

Overrides:

getSourceAddressAsString in class AbstractActivity

Returns:

a human-readable protocol-dependant source address or null if no such address exists for this activity

getDestinationAddressAsString

public String getDestinationAddressAsString()

Description copied from interface: Activity

An address that can be interpreted as the destination address for this activity. Usually this address should correspond to a human readable value. Because different protocols may be defining different address formats and types, the returned value is highly dependant on the actual implementation and may be empty or null if no destination address exists at all.

Specified by:

getDestinationAddressAsString in interface Activity

Overrides:

getDestinationAddressAsString in class AbstractActivity

Returns:

a human-readable protocol-dependant destination address or null if no such address exists for this activity

toString

public String toString()

Overrides:

toString in class AbstractActivity