Physical network tapping
13.4 Physical network tapping
Although there would be no conceivable reason for software to read data at this low level, it might be important to know whether the phone line is connected to the computer or not.
A program might also want to determine the type of connection the computer has to the Internet. To cite an example, when developing a peer- to-peer network, clients that have a fast connection via a LAN should be given higher weighting in the index server(s) than 56K dial-up connections. This would ensure that new clients do not waste time attempting to con- nect to dial-up connections, which would be more than likely discon- nected, but instead run queries against more reliable, faster connections.
The Adapter.LinkType and Adapter.LinkSpeed properties of PacketX provide information on the network type (Table 13.10) and link speed in bits per second, respectively.
Using WinPCap and PacketX may seem like overkill to determine whether a computer is connected to the Internet, but you could, of course, always ping a well-known Web site address or use the getInternetCon- nectedState API function call.
In .NET version 2 (Whidbey), the NetworkInformation class provides a simple mechanism to determine whether a computer is connected to the network as follows:
Table 13.10 Link types.
Link Type Code
Meaning
0 None 1 Ethernet (802.3) 2 Token Ring (802.5) 3 FDDI (Fiber Distributed Data Interface) 4 WAN (Wide Area Network) 5 LocalTalk
13.4 Physical network tapping 367
Table 13.10 Link types. (continued)
Link Type Code
Meaning
6 DIX (DEC- Intel - Xerox) 7 ARCNET (raw) 8 ARCNET (878.2) 9 ATM (Asynchronous Transfer Mode) 10 Wireless
C#
NetworkInformation netInfo = new NetworkInformation(); If (netInfo.GetIsConnected() == true) {
// connected to network }
VB.NET
Dim netInfo as new NetworkInformation() If (netInfo.GetIsConnected()= True)
' connected to network end if
The NetworkInformation class (Table 13.11) inherits from Sys- tem.Net.NetworkInformation . It contains a host of useful properties, which describe low-level network activities. The last five methods listed in table 13.11 may be alternatively retrieved from the GetNetworkParams Windows API function.
The ActiveUdpListener class, as returned by GetActiveUdpListeners , is descried in Table 13.12. This is equivalent to calling the GetUdpTable Windows API, or running NETSTAT -p udp -a from the command line.
Table 13.11 Significant members of the NetworkInformation class .
Method or Property
Purpose
AddressChanged Sets AddressChangedEventHandler (Object,EventArgs) delegate.
GetActiveUdpListeners Lists all active UDP ports. Returns ActiveUdpListener[] .
Chapter 13
368 13.4 Physical network tapping
Table 13.11 Significant members of the NetworkInformation class (continued).
Method or Property
Purpose
GetIcmpV4Statistics Retrieves statistics of ping (ICMP) activity. Returns IcmpV4Statistics .
GetIPStatistics Retrieves statistics of IP activity. Returns IPStatistics .
GetIsConnected Determines if the computer is connected to the network. Returns Boolean .
GetNetworkInterfaces Retrieves information about connected network hardware. Returns NetworkInterface[] .
GetTcpConnections Retrieves statistics of TCP/IP activity. Returns TcpStatistics .
GetUdpStatistics Retrieves statistics of UDP/IP activity. Returns UdpStatistics .
DhcpScopeName Gets the DHCP scope name. Returns String . DomainName
Gets the locally registered domain name. Returns String .
HostName Gets the host name for the local computer. Returns String .
IsWinsProxy Specifies if the computer is acting as a WINS proxy. Returns Boolean .
NodeType Gets the NetBIOS node type of the computer. Returns NodeType (e.g., broadcast, P2P, mixed, hybrid).
Table 13.12 Significant members of the ActiveUdpListener class.
Method or Property
Purpose
LocalEndPoint The logical location of the port holding the active UDP connection. Returns IPEndPoint
The IcmpV4Statistics class, as returned by GetIcmpV4Statistics , is described in Table 13.13 (all properties return int64 unless otherwise specified). This class is equivalent to the GetIcmpStatistics Windows IP Helper API.
13.4 Physical network tapping 369
Table 13.13 Significant members of the IcmpV4Statistics class .
Method or Property Purpose
AddressMaskRepliesReceived Gets the number of address mask replies received
AddressMaskRepliesSent Gets the number of address mask replies sent
AddressMaskRequestsReceived Gets the number of address mask requests received
AddressMaskRequestsSent Gets the number of address mask requests sent
DestinationUnreachableMessagesReceived Gets the number of destina- tion unreachable messages received
DestinationUnreachableMessagesSent Gets the number of destina- tion unreachable messages sent
EchoRepliesReceived Gets the number of echo replies received
EchoRepliesSent Gets the number of echo replies sent
EchoRequestsReceived Gets the number of echo requests received
EchoRequestsSent Gets the number of echo requests sent
ErrorsReceived Gets the number of errors received
ErrorsSent Gets the number of errors sent MessagesReceived
Gets the number of messages received
MessagesSent Gets the number of messages sent
ParameterProblemsReceived Gets the number of parame- ter problems received
ParameterProblemsSent Gets the number of parame- ter problems sent
Chapter 13
370 13.4 Physical network tapping
Table 13.13 Significant members of the IcmpV4Statistics class (continued).
Method or Property Purpose
RedirectsReceived Gets the number of redirects received
RedirectsSent Gets the number of redirects sent
SourceQuenchesReceived Gets the number of source quenches received
SourceQuenchesSent Gets the number of source quenches sent
TimeExceededMessagesReceived Gets the number of time exceeded messages received
TimeExceededMessagesSent Gets the number of time exceeded messages sent
TimestampRepliesReceived Gets the number of times- tamp replies received
TimestampRepliesSent Gets the number of times- tamp replies sent
TimestampRequestsReceived Gets the number of times- tamp requests received
TimestampRequestsSent Gets the number of times- tamp requests sent
The IPStatistics class, as returned by GetIPStatistics , is described in Table 13.14 (all properties return int64 unless otherwise specified). This is equivalent to calling the GetIpStatistics Windows IP Helper API, or running NETSTAT -s from the command line.
Table 13.14 Significant members of the IPStatistics class .
Method or Property Purpose
DefaultTtl Gets the default TTL ForwardingEnabled
Determines if forwarding is enabled; returns Boolean
Interfaces Gets the number of interfaces
13.4 Physical network tapping 371
Table 13.14 Significant members of the IPStatistics class (continued).
Method or Property Purpose
IPAddresses Gets the number of IP addresses
OutputPacketRequests Gets the number of output packet requests
OutputPacketRoutingDiscards Gets the number of output packet routing discards
OutputPacketsDiscarded Gets the number of output packets discarded
OutputPacketsWithNoRoute Gets the number of output packets with no route
PacketFragmentFailures Gets the number of packet fragment failures
PacketReassembliesRequired Gets the number of packet reassemblies required
PacketReassemblyFailures Gets the number of packet reassembly failures
PacketReassemblyTimeout Retrieves the packet reassem- bly timeout
PacketsFragmented Gets the number of packets fragmented
PacketsReassembled Gets the number of packets reassembled
ReceivedPackets Gets the number of received packets
ReceivedPacketsDelivered Gets the number of received packets delivered
ReceivedPacketsDiscarded Gets the number of received packets discarded
ReceivedPacketsForwarded Gets the number of received packets forwarded
ReceivedPacketsWithAddressErrors Gets the number of received packets with address errors
ReceivedPacketsWithHeadersErrors Gets the number of received packets with headers errors
Chapter 13
372 13.4 Physical network tapping
Table 13.14 Significant members of the IPStatistics class (continued).
Method or Property Purpose
ReceivedPacketsWithUnknownProtocol Gets the number of received packets with unknown proto- col
Routes Gets the number of routes used
The NetworkInterface class, as returned by GetNetworkInterfaces , is described in Table 13.15.
Table 13.15 Significant members of the NetworkInterface class .
Method or Property
Purpose
GetInterfaceStatistics Retrieves information on network activity on the interface. Returns InterfaceStatistics .
GetIPAddressInformation Returns information on the IP address assigned to the interface. Returns IPAddressInformation .
GetIPv4Properties Gets information concerning local IP routing, etc. Returns IPv4Properties .
GetPhysicalAddress Retrieves the interface’s MAC address. Returns byte[] .
Description A friendly name for the interface. Returns
String .
DnsEnabled Determines if DNS is enabled on the interface. Returns Boolean .
DynamicDnsEnabled Determines if Dynamic DNS is enabled on the interface. Returns Boolean .
Ipv4Index Determines the IP version 4 index on the interface. Returns int64 .
Ipv6Index Determines the IP version 6 index on the interface. Returns int64 .
IPVersionSupported Determines the IP version(s) supported by the interface. Returns IPVersionSupportedFlags .
IsConnected Determines if the interface is connected to an active network. Returns Boolean .
13.4 Physical network tapping 373
Table 13.15 Significant members of the NetworkInterface class (continued).
Method or Property
Purpose
Mtu Determines the maximum transmission unit of the interface. Returns int64 .
Name Gets a name for the interface. Returns string. OperationalStatus
Gets the operational status of the interface. Returns OperationalStatus .
Type Determines the interface hardware. Returns InterfaceType (e.g., modem, ISDN, ADSL, Ethernet, etc.).
The InterfaceStatistics class, as returned by GetInterfaceStatis- tics , is described in Table 13.16 (all properties return int64 unless other- wise specified).
Table 13.16 Significant members of the InterfaceStatistics class .
Method or Property
Purpose
BytesReceived Gets the number of bytes received BytesSent
Gets the number of bytes sent IncomingPacketsDiscarded
Gets the number of incoming packets discarded
IncomingPacketsWithErrors Gets the number of incoming packets with errors
IncomingUnknownProtocolPackets Gets the number of incoming unknown protocol packets
NonUnicastPacketsReceived Gets the number of non-Unicast packets received
NonUnicastPacketsSent Gets the number of non-Unicast packets sent
OutgoingPacketsDiscarded Gets the number of outgoing packets discarded
OutgoingPacketsWithErrors Gets the number of outgoing packets with errors
OutputQueueLength Gets the number of output queue length
Chapter 13
374 13.4 Physical network tapping
Table 13.16 Significant members of the InterfaceStatistics class (continued).
Method or Property
Purpose
Speed Gets the speed of the interface UnicastPacketsReceived
Gets the number of Unicast packets received
UnicastPacketsSent Gets the number of Unicast packets sent
The IPAddressInformation class, as returned by GetIPAddressInfor- mation , is described in Table 13.17.
Table 13.17 Significant members of the IPAddressInformation class.
Method or Property
Purpose
Address
Gets the IP address
DnsEligible Determines if the address is eligible for DNS Transient
Determines if the address is transient
The IPv4Properties class, as returned by GetIPv4Properties , is described in Table 13.18. These properties may be alternatively ascertained on an adapter-by-adapter basis through the GetAdaptersInfo Windows IP Helper API function.
Table 13.18 Significant members of the IPv4Properties class .
Method or Property
Purpose
GetDhcpServerAddresses Retrieves the local DHCP server addresses. Returns IPAddress[] .
GetGatewayAddresses Retrieves the local gateway addresses. Returns IPAddress[] .
GetWinsServersAddresses Retrieves the local WINS servers addresses. Returns IPAddress[] .
AutomaticPrivateAddressingActive Determines if automatic private addressing is active. Returns Boolean .
13.4 Physical network tapping 375
Table 13.18 Significant members of the IPv4Properties class (continued).
Method or Property
Purpose
AutomaticPrivateAddressingEnabled Determines if automatic private addressing is enabled. Returns Boolean .
DhcpEnabled Determines if DHCP is enabled. Returns Boolean .
RoutingEnabled Determines if routing is enabled. Returns Boolean .
UsesWins Determines if the computer uses WINS. Returns Boolean .
The TcpStatistics class, as returned by GetTcpStatistics , is described in Table 13.19 (all properties return int64 unless otherwise stated). This is equivalent to calling the GetTcpTable Windows IP Helper API, or running NETSTAT -p tcp -a from the command line.
Table 13.19 Significant members of the TcpStatistics class .
Method or Property
Purpose
ConnectionsAccepted Determines the number of connections accepted
ConnectionsInitiated Determines the number of connections ini- tiated
CumulativeConnections Determines the number of cumulative con- nections
CurrentConnections Determines the number of current connec- tions
ErrorsReceived Determines the number of errors received FailedConnectionAttempts
Determines the number of failed connection attempts
MaximumConnections Determines the maximum number of con- nections
MaximumTransmissionTimeOut Determines the maximum transmission time out
Chapter 13
376 13.5 Conclusion
Table 13.19 Significant members of the TcpStatistics class (continued).
Method or Property
Purpose
MinimumTransmissionTimeOut Determines the minimum transmission time out
ResetConnections Determines the number of reset connections SegmentsReceived
Determines the number of segments received
SegmentsResent Determines the number of segments resent SegmentsSent
Determines the number of segments sent SegmentsSentWithReset
Determines the number of segments sent with reset
The UdpStatistics class, as returned by GetUdpStatistics , is described in Table 13.20 (all properties return int64 unless otherwise stated). This is equivalent to the GetUdpStatistics Windows IP Helper
API function.
Table 13.20 Significant members of the UdpStatistics class.
Method or Property
Purpose
DatagramsReceived Determines the number of datagrams received
DatagramsSent Determines the number of datagrams sent IncomingDatagramsDiscarded
Determines the number of incoming data- grams discarded
IncomingDatagramsWithErrors Determines the number of incoming data- grams with errors
UdpListeners Determines the number of active UDP lis- teners