C# SharpPcap issues

Question

I've been very interested in using SharpPcap , but so far it's not been going well.

The main problem is the following code:

   private static void device_OnPacketArrival(object sender, CaptureEventArgs packet)
   {
        if(packet is TCPPacket)
        {                
            DateTime time = packet.Timeval.Date;
            int len = packet.PcapHeader.len;

            TCPPacket tcp = (TCPPacket)packet;
            string srcIp = tcp.SourceAddress;
            string dstIp = tcp.DestinationAddress;
            int srcPort = tcp.SourcePort;
            int dstPort = tcp.DestinationPort;

            Console.WriteLine("{0}:{1}:{2},
                {3} Len={4} {5}:{6} -> {7}:{8}", 
                time.Hour, time.Minute, time.Second, 
                time.Millisecond, len, srcIp, srcPort, 
                dstIp, dstPort);
        }
    }

"The type or namespace TCPPacket could not be found"

OK, so I figured it must be TcpPacket? -but then it came up with this error:

"The given expression is never of the provided ('PacketDotNet.TcpPacket') type"

Ignoring that:

"'SharpPcap.CaptureEventArgs' does not contain a definition for 'Timeval' and no extension method 'Timeval' accepting a first argument of type 'SharpPcap.CaptureEventArgs' could be found"

And so on, and so on. So my question is, am I missing something?

I have the PacketDotNet and SharpPcap library's, and added both the using statements.

Solution: Packet pack = Packet.ParsePacket(packet.Packet); TcpPacket tcpPacket = TcpPacket.GetEncapsulated(pack);

    DateTime time = packet.Packet.Timeval.Date;
    int len = packet.Packet.Data.Length;

    if (tcpPacket != null)
    {
        IpPacket ipPacket = (IpPacket)tcpPacket.ParentPacket;


            IPAddress srcIp = ipPacket.SourceAddress;
            IPAddress dstIp = ipPacket.DestinationAddress;
            ushort srcPort = tcpPacket.SourcePort;
            ushort dstPort = tcpPacket.DestinationPort;

            MessageBox.Show(String.Format("{0}:{1}:{2},{3} Len={4} {5}:{6} -> {7}:{8}",
                                time.Hour, time.Minute, time.Second, time.Millisecond, len,
                                srcIp, srcPort, dstIp, dstPort)
                );
    }

Answer 1

Solution:

Packet pack = Packet.ParsePacket(packet.Packet);
TcpPacket tcpPacket = TcpPacket.GetEncapsulated(pack);

DateTime time = packet.Packet.Timeval.Date;
int len = packet.Packet.Data.Length;

if (tcpPacket != null)
{
    IpPacket ipPacket = (IpPacket)tcpPacket.ParentPacket;


        IPAddress srcIp = ipPacket.SourceAddress;
        IPAddress dstIp = ipPacket.DestinationAddress;
        ushort srcPort = tcpPacket.SourcePort;
        ushort dstPort = tcpPacket.DestinationPort;

        MessageBox.Show(String.Format("{0}:{1}:{2},{3} Len={4} {5}:{6} -> {7}:{8}",
                            time.Hour, time.Minute, time.Second, time.Millisecond, len,
                            srcIp, srcPort, dstIp, dstPort)
            );
}

Answer 2

Looking at the first part of the code...

private static void device_OnPacketArrival(object sender, CaptureEventArgs packet)
   {
        if(packet is TCPPacket)
        {    

packet seems to be of type CaptureEventArgs, not TCPPacket. Probably there's some property of the event args which is your actual packet. If that is correct, then the

"'SharpPcap.CaptureEventArgs' does not contain a definition for 'Timeval' and no extension method 'Timeval' accepting a first argument of type 'SharpPcap.CaptureEventArgs' could be found"

Is probably true for that reason; the CaptureEventArgs and the Packet are not the same thing.

EDIT:

I would try something like:

private static void device_OnPacketArrival(object sender, CaptureEventArgs packet)
   {
        if(packet.packet is TCPPacket)
        {               
            TCPPacket tcpPack = (TCPPacket)(packet.packet);
            DateTime time = tcpPack.Timeval.Date;
            int len = tcpPack.PcapHeader.len;           
            string srcIp = tcpPack.SourceAddress;
            string dstIp = tcpPack.DestinationAddress;
            int srcPort = tcpPack.SourcePort;
            int dstPort = tcpPack.DestinationPort;

            Console.WriteLine("{0}:{1}:{2},
                {3} Len={4} {5}:{6} -> {7}:{8}", 
                time.Hour, time.Minute, time.Second, 
                time.Millisecond, len, srcIp, srcPort, 
                dstIp, dstPort);
        }
    }