Parsing Network Packets in XML format using C#: XPath or XDocument

Question

I am trying to draw out key data from packets. The data in question is IP source, IP destination and Port destination. Below is an extract of a packet in xml form. I am trying to take out this information and display it in a form.

<pdml>
<packet>
<proto name="ip" showname="Internet Protocol Version 4, Src: 192.168.1.204 (192.168.1.204), Dst: 162.159.242.165 (162.159.242.165)" size="20" pos="14">      
  <field name="ip.src" showname="Source: 192.168.1.204 (192.168.1.204)" size="4" pos="26" show="192.168.1.204" value="c0a801cc"/>
  <field name="ip.dst" showname="Destination: 162.159.242.165 (162.159.242.165)" size="4" pos="30" show="162.159.242.165" value="a29ff2a5"/>
</proto>
<proto name="tcp" showname="Transmission Control Protocol, Src Port: 6287 (6287), Dst Port: 443 (443), Seq: 1, Ack: 1, Len: 0" size="20" pos="34">
  <field name="tcp.dstport" showname="Destination Port: 443 (443)" size="2" pos="36" show="443" value="01bb"/>
</proto>
</packet>
</pdml>

I am having trouble trying to do so and have tried both XPath and XDocument to no avail (followed different examples but nothing worked). My code currently looks like this:

public void LoadPackets()
    {
        var xmlDoc2 = new XmlDocument();
        xmlDoc2.Load("Packets.xml");
        var node = xmlDoc2.SelectSingleNode("/pdml/packet/proto/field[text()='ip.src'];
        string ipsrc = node.InnerText;
        string ipdst = ("Carrot");
        string portdst = ("Carrot");

            list.Items.Add(new PacketFilter(ipsrc, ipdst, portdst));
    }

Obviously, you can ignore the carrot text it was just to fill them up whilst trying to figure out the ip source address.

Currently I am getting the message:

Additional information: Expression must evaluate to a node-set.

But for the life of me can't figure out why. Any help on the matter would be great. I don't mind using either XPath or XDocument as long as it works.

Thanks, Tom.

Answer 1

You are not getting correct result because your XPath is wrong, 'text()' function finds text nodes, but you want to select by attribute value, so you need to change it like:

var node = xmlDoc2.SelectSingleNode("pdml/packet/proto/field[@name='ip.src']/@show");
string ipsrc = node.Value; //ipsrc = 192.168.1.204

or select all fields, like this:

var elements = xmlDoc2.SelectNodes("//field");

foreach (XmlNode element in elements)
{
  Debug.WriteLine("Name: {0} Value: {1}", element.Attributes["name"].Value, element.Attributes["show"].Value);
}
//Outputs
Name: ip.src Value: 192.168.1.204
Name: ip.dst Value: 162.159.242.165
Name: tcp.dstport Value: 443

With XDocument you can do something like this to get a list of all fields:

XDocument doc = //load your data into XDocument    
var elements = from e in doc.Descendants("field")
               select new { 
                            Name = (string)e.Attribute("name"),
                            Value = (string)e.Attribute("show")
                          };

As a result you'll get same output:

foreach (var element in elements)
{
  Debug.WriteLine("Name: {0} Value: {1}", element.Name, element.Value);
}
Name: ip.src Value: 192.168.1.204
Name: ip.dst Value: 162.159.242.165
Name: tcp.dstport Value: 443