/home/cmorgan/hdd/packetnet_git/PacketDotNet/bin/Release/PacketDotNet Represents an application layer packet as described at http://en.wikipedia.org/wiki/Application_Layer ApplicationPacket constructor Format of an 802.11 management action frame. These frames are used by the 802.11e (QoS) and 802.11n standards to request actions of stations. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier. Gets the size of the frame in bytes The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Reassociation request frame. Sent when a wireless client is going from one access point to another http://en.wikipedia.org/wiki/IEEE_802.11#Frames Constructor A Initializes a new instance of the class. Source address. Destination address. BssId. Information elements. Frame control bytes are the first two bytes of the frame Gets or sets the capability information, the type of network the mobile station wants to join The capability information. Gets or sets the listen interval. This is the number of beacon interval time periods that the access point must retain buffered packets for. The listen interval. Gets or sets the listen interval, the length of buffered frame retention The listen interval. DestinationAddress Gets or sets the information elements. The information elements. Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Block acknowledgment control field. Initializes a new instance of the class. Initializes a new instance of the class. Field. The available block acknowledgement policies. The acknowledgement does not have to be sent immediately after the request The acknowledgement must be sent immediately after the request The block acknowledgement policy in use True if the acknowledgement can ack multi traffic ids True if the frame is using a compressed acknowledgement bitmap. Newer standards used a compressed bitmap reducing its size The traffic id being ack'd Gets or sets the field. This provides direct access to the bytes that back all the other properties in the field. The field. Format of the 802.11 block acknowledgment frame. http://en.wikipedia.org/wiki/Block_acknowledgement Constructor A Initializes a new instance of the class. Transmitter address. Receiver address. The Block ack bitmap signalling the receive status of the MSDUs. Receiver address Transmitter address Gets or sets the block ack request control bytes. The block ack request control bytes. Block acknowledgment control field Gets or sets the block ack starting sequence control. The block ack starting sequence control. Gets or sets the block ack bitmap used to indicate the receive status of the MPDUs. The block ack bitmap. Is thrown when the bitmap is of an incorrect lenght. The bitmap must be either 8 or 64 btyes longs depending on whether or not it is compressed. Length of the frame Writes the current packet properties to the backing ByteArraySegment. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Format of an 802.11 management association response frame. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (MAC Address of Access Point). Information elements. The raw capability information bytes The capability information field that describes the networks capabilities. Value indicating the success or failure of the association. The id assigned to the station by the access point to assist in management and control functions. Although this is a 16bit field only 14 of the bits are used to represent the id. Therefore the available values for this field are inthe range 1-2,007. The information elements included in the frame Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Format of an 802.11 management association frame. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (MAC Address of Access Point). Information elements. Frame control bytes are the first two bytes of the frame Gets or sets the capability information. The capability information. Gets or sets the listen interval. The listen interval. Gets or sets the information elements. The information elements. Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Format of an 802.11 management authentication frame. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (MAC Address of Access Point). Information elements. Number used for selection of authentication algorithm Sequence number to define the step of the authentication algorithm Indicates the success or failure of the authentication operation The information elements included in the frame Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. The potential results of authentication or association operations. Constant success. Constant unspecified failure. Constant requested capability unsupportable. Constant unidentifiable prior association. Constant non standard unspecified denial. Constant authentication algorithm not supported. Constant unexpected sequenec number. Constant response to challenge failed. Constant next frame outside expected window. Constant access point resource constrained. Constant station doesnt support data rates. Constant station doesnt support preamble. Constant station doesnt support pbcc modulation. Constant station doesnt support channel agility. Constant spectrum management required. Constant unacceptable power capability value. Constant unacceptable supported channels value. Constant station doesnt support short time slot. Constant station doesnt support dsss ofdm. Constant invalid information element. Constant invalid group cipher. Constant invalid pairwise cipher. Constant invalid authentication and key management protocol. Constant unsupported rsn information element version. Constant unsupported rsn ie capabilities. Constant cipher suite policy rejection. Block acknowledgment request frame. Constructor A Initializes a new instance of the class. Transmitter address. Receiver address. Receiver address Transmitter address Block acknowledgment control bytes are the first two bytes of the frame Block acknowledgment control field Gets or sets the sequence number of the first MSDU for which this block acknowledgement request frame is sent The block ack starting sequence control field value Gets or sets the block ack starting sequence control. The block ack starting sequence control. Length of the frame Writes the current packet properties to the backing ByteArraySegment. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Deauthentication frame. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (MAC Address of the Access Point). Gets the reason for deauthentication. The reason. Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Represents a Layer 2 protocol. DataLinkPacket constructor See http://en.wikipedia.org/wiki/Ethernet#Ethernet_frame_types_and_the_EtherType_field Construct a new ethernet packet from source and destination mac addresses Constructor A Payload packet, overridden to set the 'Type' field based on the type of packet being used here if the PayloadPacket is being set MAC address of the host where the packet originated from. MAC address of the host where the packet originated from. Type of packet that this ethernet packet encapsulates Fetch ascii escape sequence of the color associated with this packet type. Used by the EthernetPacket constructor. Located here because the LinuxSLL constructor also needs to perform the same operations as it contains an ethernet type A A A Returns the EthernetPacket inside of the Packet p or null if there is no encapsulated packet A A Generate a random EthernetPacket TODO: could improve this routine to set a random payload as well A Copied from Pcap.Net @ 20091117 Code constants for well-defined ethernet protocols. EtherType is a two-octet field in an Ethernet frame, as defined by the Ethernet II framing networking standard. It is used to indicate which protocol is encapsulated in the payload. Also contains entries taken from linux/if_ether.h and tcpdump/ethertype.h No Ethernet type Internet Protocol, Version 4 (IPv4) Address Resolution Protocol (ARP) Reverse Address Resolution Protocol (RARP) Wake-On-Lan (WOL) AppleTalk (Ethertalk) AppleTalk Address Resolution Protocol (AARP) VLAN-tagged frame (IEEE 802.1Q) Novell IPX (alt) Novell Internet Protocol, Version 6 (IPv6) MAC Control CobraNet MPLS unicast MPLS multicast PPPoE Discovery Stage PPPoE Session Stage EAP over LAN (IEEE 802.1X) HyperSCSI (SCSI over Ethernet) ATA over Ethernet EtherCAT Protocol Provider Bridging (IEEE 802.1ad) AVB Transport Protocol (AVBTP) Link Layer Discovery Protocol (LLDP) SERCOS III Circuit Emulation Services over Ethernet (MEF-8) HomePlug MAC security (IEEE 802.1AE) Precision Time Protocol (IEEE 1588) IEEE 802.1ag Connectivity Fault Management (CFM) Protocol / ITU-T Recommendation Y.1731 (OAM) Fibre Channel over Ethernet FCoE Initialization Protocol Q-in-Q Veritas Low Latency Transport (LLT) Ethernet loopback packet Ethernet echo packet Format of an 802.11 management beacon frame. Beacon frames are used to annouce the existance of a wireless network. If an access point has been configured to not broadcast its SSID then it may not transmit beacon frames. Constructor A Initializes a new instance of the class. Source address. Bss identifier (MAC Address of the Access Point). Information elements. The number of microseconds the networks master timekeeper has been active. Used for synchronisation between stations in an IBSS. When it reaches the maximum value the timestamp will wrap (not very likely). The number of "time units" between beacon frames. A time unit is 1,024 microseconds. This interval is usually set to 100 which equates to approximately 100 milliseconds or 0.1 seconds. Frame control bytes are the first two bytes of the frame Defines the capabilities of the network. Gets the size of the frame. The size of the frame. The information elements included in the frame Most (but not all) beacons frames will contain an Information element that contains the SSID. Writes the current packet properties to the backing ByteArraySegment. Capability information field. Initializes a new instance of the class. Constructor A Is set to 1 when the beacon frame is representing an ESS (as opposed to an IBSS) This field and IsIbss should be mutually exclusive Is set to 1 when the beacon frame is representing an IBSS (as opposed to an ESS) This field and IsEss should be mutually exclusive Gets or sets a value indicating whether this cf pollable. true if cf pollable; otherwise, false. Gets or sets a value indicating whether this cf poll request. true if cf poll request; otherwise, false. Gets or sets a value indicating whether this is privacy. true if privacy; otherwise, false. Gets or sets a value indicating whether this short preamble. true if short preamble; otherwise, false. Gets or sets a value indicating whether this is pbcc. true if pbcc; otherwise, false. Gets or sets a value indicating whether this channel agility. true if channel agility; otherwise, false. Gets or sets a value indicating whether this short time slot. true if short time slot; otherwise, false. Gets or sets a value indicating whether this dss ofdm. true if dss ofdm; otherwise, false. Gets or sets the field. The field. Returns true if the bit is set false if not. 0 indexed position of the bit Contention free end frame. Constructor A Initializes a new instance of the class. Receiver address. Bss identifier (MAC Address of the Access Point). Receiver address BSS ID Length of the frame Writes the current packet properties to the backing ByteArraySegment. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Data data frame. Initializes a new instance of the class. Bas. Initializes a new instance of the class. Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Data frame. SourceAddress DestinationAddress ReceiverAddress TransmitterAddress BssID Frame control bytes are the first two bytes of the frame Sequence control field Assigns the default MAC address of 00-00-00-00-00-00 to all address fields. Reads the addresses from the backing ByteArraySegment into the the address properties. The ToDS and FromDS properties dictate which of the 4 possible address fields is read into which address property. Writes the address properties into the backing . The address position into which a particular address property is written is determined by the value of ToDS and FromDS properties. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Disassociation frame. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (MAC Address of the Access Point). Gets or sets the reason for disassociation. The reason. Gets the size of the frame. The size of the frame. Writes the current packet properties to the backing ByteArraySegment. Duration field. Initializes a new instance of the class. Constructor A This is the raw Duration field Every 802.11 frame has a control field that contains information about the frame including the 802.11 protocol version, frame type, and various indicators, such as whether WEP is on, power management is active. Initializes a new instance of the class. Constructor A Specifies the main frame type: Control, Management or Data. Management frame. Control frame. Data frame. Sepcifies the frame types down to the sub type level. Association request Association response Reassociation request Reassociation response Probe request Probe response Reserved 0 Reserved 1 Beacon ATIM Disassociation Authentication Deauthentication Reserved 2 Reserved 3 Blck Acknowledgment Request (QOS) Blck Acknowledgment (QOS) PS poll RTS CTS ACK CF-End CF-End CF-Ack Data CF-ACK CF-Poll CF-Ack CF-Poll Null function no data CF-Ack No data CF-Poll no data CF-Ack CF-Poll no data Constant qos data. Constant qos data and CF ack. Constant qos data and CF poll. Constant qos data and CF ack and CF poll. Constant qos null data. Constant qos CF ack. Constant qos CF poll. Constant qos CF ack and CF poll. Protocol version Gets the type of the frame. The type. Helps to identify the type of WLAN frame, control data and management are the various frame types defined in IEEE 802.11 Is set to 1 when the frame is sent to Distribution System (DS) Is set to 1 when the frame is received from the Distribution System (DS) More Fragment is set to 1 when there are more fragments belonging to the same frame following the current fragment Indicates that this fragment is a retransmission of a previously transmitted fragment. (For receiver to recognize duplicate transmissions of frames) Indicates the power management mode that the station will be in after the transmission of the frame Indicates that there are more frames buffered for this station Indicates that the frame body is encrypted according to the WEP (wired equivalent privacy) algorithm Bit is set when the "strict ordering" delivery method is employed. Frames and fragments are not always sent in order as it causes a transmission performance penalty. Gets or sets the field. The field. Returns a that represents the current . A that represents the current . Information element, a variable-length component of management frames Is thrown when an argument passed to a method is invalid. Initializes a new instance of the class. The bytes of the information element. The Offset property should point to the first byte of the element, the Id byte Initializes a new instance of the class. Identifier. Value. Is thrown when an argument passed to a method is invalid. Types of information elements Assign an identifier to the service set Specifies the data rates supported by the network Provides the parameters necessary to join a frequency-hopping 802.11 network Direct-sequence 802.11 networks have one parameter, the channel number of the network Contention-free parameter. Transmitted in Becons by access points that support contention-free operation. Indicates which stations have buffered traffic waiting to be picked up Indicates the number of time units (TUs) between ATIM frames in an IBSS. Specifies regulatory constraints stations must adhere to based on the country the network is operating in. Specifies the hopping pattern of timeslots used in frequency hopping physical layers. Specifies the hopping pattern table used in frequency hopping physical layers. Specifies the Ids of the information elements being requested in a . Specifies the encrypted challenge text that stations must decrypt as part of the authentication process. Specifies the difference between the regulatory maximum transmit power and any local constraint. Specifies the minimum and maximum transmit power a station is capable of. Used to request radio link management information. This type of information element never has an associated value. Radio link managment report used by stations to tune their transmission power. Specifies local constraints on the channels in use. Announces an impending change of channel for the network. Requests a report on the state of the radio channel. A report of on the status of the radio channel. Specifies the scheduling of temporary quiet periods on the channel. Specifies the details the Dynamic Frequency Selection (DFS) algorithm in use in the IBSS. Indicates whether or not the Extended Rate PHY is in use on the network at that time. Specifies a stations high throughput capabilities. Specifies details of the Robust Security Network encryption in use on the network. Specifies more data rates supported by the network. This is identical to the Supported Rates element but it allows for a longer value. Specified how high throughput capable stations will be operated in the network. Specifies details of the WiFi Protected Access encryption in use on the network. Non standard information element implemented by the hardware vendor. The length in bytes of the Information Element id field. The length in bytes of the Information Element length field. The index of the id field in an Information Element. The index of the length field in an Information Element. The index of the first byte of the value field in an Information Element. Gets or sets the identifier. The identifier. Gets the length. The length. Gets the length of the element including the Id and Length field The length of the element. Gets or sets the value of the element The value. Is thrown when the value is too large. Values are limited to a maximum size 255 bytes due the single byte length field. Gets the bytes. The bytes. Determines whether the specified is equal to the current . The to compare with the current . true if the specified is equal to the current ; otherwise, false. Serves as a hash function for a object. A hash code for this instance that is suitable for use in hashing algorithms and data structures such as a hash table. NOTE: All positions are not defined here because the frame type changes whether some address fields are present or not, causing the sequence control field to move. In addition the payload size determines where the frame control sequence value is as it is after the payload bytes, if any payload is present Not all MAC Frames contain a sequence control field. The value of this field is only meaningful when they do. Base class of all 802.11 frame types Frame control bytes are the first two bytes of the frame Frame control field Duration bytes are the third and fourth bytes of the frame Gets or sets the duration value. The value represents the number of microseconds the the wireless medium is expected to remain busy. The duration field value Frame check sequence, the last thing in the 802.11 mac packet Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. FCSs the valid. The valid. Gets or sets a value indicating whether this should include an FCS at the end of the array returned by Bytes. true if append FCS should be appended; otherwise, false. The option to return a ByteArraySegment means that this method is higher performance as the data can start at an offset other than the first byte. Writes the address into the specified address position. The number of valid address positions in a MAC frame is determined by the type of frame. There are between 1 and 4 address fields in MAC frames Zero based address to look up Writes the provided address into the backing starting at the provided offset. The position where the address should start to be copied Address. Gets the address. There can be up to four addresses in a MacFrame depending on its type. The address. Address index. Gets an address by offset. The address as the specified index. The offset into the packet buffer at which to start parsing the address. Recalculates and updates the frame check sequence. After calling this method the FCS will be valud regardless of what the packet contains. Returns the number of bytes of payload data currently available in the buffer. This method is used to work out how much space there is for the payload in the underlying ByteArraySegment. To find out the length of actual payload assigned to the packet use PayloadData.Length. The number of bytes of space available after the header for payload data. Parses the into a MacFrame. The parsed MacFrame or null if it could not be parsed. The bytes of the packet. bas.Offset should point to the first byte in the mac frame. If the provided bytes dont contain the FCS then call instead. The presence of the FCS is usually determined by configuration of the device used to capture the packets. Parses the into a MacFrame. The parsed MacFrame or null if it could not be parsed. The bytes of the packet. bas.Offset should point to the first byte in the mac frame. If the provided bytes contain the FCS then call instead. The presence of the FCS is usually determined by configuration of the device used to capture the packets. Calculates the FCS value for the provided bytes and compates it to the FCS value passed to the method. true if the FCS for the provided bytes matches the FCS passed in, false if not. The byte array for which the FCS will be calculated. The offset into data of the first byte to be covered by the FCS. The number of bytes to calculate the FCS for. The FCS to compare to the one calculated for the provided data. This method can be used to check the validity of a packet before attempting to parse it with either or . Attempting to parse a corrupted buffer using these methods could cause unexpected exceptions. ToString() override A Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Format of a CTS or an ACK frame DestinationAddress SourceAddress BssID Frame control bytes are the first two bytes of the frame Sequence control field Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Null data frames are like normal data frames except they carry no payload. They are primarily used for control purposes such as power management or telling an Access Point to buffer packets while a station scans other channels. Initializes a new instance of the class. A Initializes a new instance of the class. Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. Writes the current packet properties to the backing ByteArraySegment. Probe request frames are used by stations to scan the area for existing networks. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (Mac Address of the Access Point). Information elements. Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. Gets or sets the information elements included in the frame. The information elements. Probe request frames normally contain information elements for , and in that order. Writes the current packet properties to the backing ByteArraySegment. Probe response frames are sent by Access Points in response to probe requests by stations. An access point may respond to a probe request if it hosts a network with parameters compatible with those requested by the station. Constructor A Initializes a new instance of the class. Source address. Destination address. Bss identifier (Mac address of the access point). Information elements. Gets or sets the timestamp. The timestamp is used by a station to ensure that it is using the most up to date parameters for the network. The timestamp. Gets or sets the beacon interval. This is the minimum time between beacon frames from the access point. The beacon interval. Frame control bytes are the first two bytes of the frame Get or set the capability information field that defines the capabilities of the network. Gets or sets the information elements included in the frame. The information elements. Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. Writes the current packet properties to the backing ByteArraySegment. Qos data frames are like regualr data frames except they contain a quality of service field as deinfed in the 802.11e standard. Initializes a new instance of the class. A Initializes a new instance of the class. Gets or sets the qos control field. The qos control field. Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. Writes the current packet properties to the backing ByteArraySegment. The Qos null data frame serves the same purpose as but also includes a quality of service control field. Initializes a new instance of the class. A Initializes a new instance of the class. Gets or sets the qos control field. The qos control field. Length of the frame header. This does not include the FCS, it represents only the header bytes that would would preceed any payload. Writes the current packet properties to the backing ByteArraySegment. .Net analog of a ieee80211_radiotap_header from airpcap.h Initializes a new instance of the class. Gets the with the specified type, or null if the field is not in the packet. Radio Tap field type Version 0. Only increases for drastic changes, introduction of compatible new fields does not count. Length of the whole header in bytes, including it_version, it_pad, it_len and data fields Returns an array of UInt32 bitmap entries. Each bit in the bitmap indicates which fields are present. Set bit 31 (0x8000000) to extend the bitmap by another 32 bits. Additional extensions are made by setting bit 31. Array of radio tap fields Add the specified field to the packet. Field to be added Removes a field of the specified type if one is present in the packet. Field type. Checks for the presence of a field of the specified type in the packet. The field type to check for. true if the packet contains a field of the specified type; otherwise, false. Called to ensure that field values are updated before the packet bytes are retrieved As defined by Airpcap.h NOTE: PresentPosition may not be the only position present as this the field can be extended if the high bit is set Length of the version field Length of the pad field Length of the length field Length of the first present field (others may follow) Position of the version field Position of the padding field Position of the length field Position of the first present field Default header length, assuming one present field entry Channel flags Turbo channel CCK channel OFDM channel 2 GHz spectrum channel 5 GHz spectrum channel Only passive scan allowed Dynamic CCK-OFDM channel GFSK channel (FHSS PHY) 11a static turbo channel only Channel field Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Tx/Rx Frequency in MHz. Flags. Channel flags Type of the field Gets the length of the field data. The length. Frequency in MHz Channel number derived from frequency Convert a frequency to a channel There is some overlap between the 802.11b/g channel numbers and the 802.11a channel numbers. This means that while a particular frequncy will only ever map to single channel number the same channel number may be returned for more than one frequency. At present this affects channel numbers 8 and 12. A A Copies the field data to the destination buffer at the specified offset. ToString() override A Fhss radio tap field Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Channel hopping set. Channel hopping pattern. Type of the field Gets the length of the field data. The length. Hop set Hop pattern Copies the field data to the destination buffer at the specified offset. ToString() override A Radio tap flags Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Flags. Flags set Type of the field Gets the length of the field data. The length. Copies the field data to the destination buffer at the specified offset. ToString() override A Rate field Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Rate mbps. Type of the field Gets the length of the field data. The length. Rate in Mbps Copies the field data to the destination buffer at the specified offset. ToString() override A Db antenna signal Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Signal strength in dB Type of the field Gets the length of the field data. The length. Signal strength in dB Copies the field data to the destination buffer at the specified offset. ToString() override A Antenna noise in dB Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Antenna signal noise in dB. Type of the field Gets the length of the field data. The length. Antenna noise in dB Copies the field data to the destination buffer at the specified offset. ToString() override A Antenna field Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Antenna index of the Rx/Tx antenna for this packet. The first antenna is antenna 0. Type of the field Gets the length of the field data. The length. Antenna number Copies the field data to the destination buffer at the specified offset. ToString() override A Antenna signal in dBm Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Antenna signal power in dB. Type of the field Gets the length of the field data. The length. Antenna signal in dBm Copies the field data to the destination buffer at the specified offset. ToString() override A Antenna noise in dBm Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Antenna noise in dBm. Type of the field Gets the length of the field data. The length. Antenna noise in dBm Copies the field data to the destination buffer at the specified offset. ToString() override A Lock quality Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Signal quality. Type of the field Gets the length of the field data. The length. Signal quality Copies the field data to the destination buffer at the specified offset. ToString() override A Tsft radio tap field Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Value in microseconds of the Time Synchronization Function timer Type of the field Gets the length of the field data. The length. Timestamp in microseconds Copies the field data to the destination buffer at the specified offset. ToString() override A Contains properties about the received from. Constructor A Initializes a new instance of the class. Initializes a new instance of the class. PLCP CRC check failed. Type of the field Gets the length of the field data. The length. Gets or sets a value indicating whether the frame failed the PLCP CRC check. true if the PLCP CRC check failed; otherwise, false. Copies the field data to the destination buffer at the specified offset. ToString() override A Transmit power expressed as unitless distance from max power set at factory calibration. 0 is max power. Monotonically nondecreasing with lower power levels. Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Transmit power expressed as unitless distance from max power set at factory calibration. 0 is max power. Type of the field Gets the length of the field data. The length. Transmit power Copies the field data to the destination buffer at the specified offset. ToString() override A Transmit power expressed as decibel distance from max power set at factory calibration. 0 is max power. Monotonically nondecreasing with lower power levels. Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Transmit power expressed as decibel distance from max power set at factory calibration. 0 is max power. Type of the field Gets the length of the field data. The length. Transmit power Copies the field data to the destination buffer at the specified offset. ToString() override A Transmit power expressed as dBm (decibels from a 1 milliwatt reference). This is the absolute power level measured at the antenna port. Constructor A Initializes a new instance of the class. Initializes a new instance of the class. Transmit power expressed as dBm (decibels from a 1 milliwatt reference). Type of the field Gets the length of the field data. The length. Tx power in dBm Copies the field data to the destination buffer at the specified offset. ToString() override A Abstract class for all radio tap fields Type of the field Gets the length of the field data. The length. Parse a radio tap field, indicated by bitIndex, from a given BinaryReader A A A Copies the field data to the destination buffer at the specified offset. Radio tap flags sent/received during cfp sent/received with short preamble sent/received with WEP encryption sent/received with fragmentation frame includes FCS frame includes padding to the 32 bit boundary between the 802.11 header and the payload fFrame failed the fcs check NOTE: Might be out-of-date information since it mentions Ethereal NOTE: ethereal does NOT handle the following: IEEE80211_RADIOTAP_FHSS: IEEE80211_RADIOTAP_LOCK_QUALITY: IEEE80211_RADIOTAP_TX_ATTENUATION: IEEE80211_RADIOTAP_DB_TX_ATTENUATION: IEEE80211_RADIOTAP_TSFT u_int64_t microseconds Value in microseconds of the MAC's 64-bit 802.11 Time Synchronization Function timer when the first bit of the MPDU arrived at the MAC. For received frames, only. IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap Properties of transmitted and received frames. See flags defined below. IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s Tx/Rx data rate IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap Tx/Rx frequency in MHz, followed by flags (see below). IEEE80211_RADIOTAP_FHSS u_int16_t see below For frequency-hopping radios, the hop set (first byte) and pattern (second byte). IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from one milliwatt (dBm) RF signal power at the antenna, decibel difference from one milliwatt. IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from one milliwatt (dBm) RF noise power at the antenna, decibel difference from one milliwatt. IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless Quality of Barker code lock. Unitless. Monotonically nondecreasing with "better" lock strength. Called "Signal Quality" in datasheets. (Is there a standard way to measure this?) IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless Transmit power expressed as unitless distance from max power set at factory calibration. 0 is max power. Monotonically nondecreasing with lower power levels. IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB) Transmit power expressed as decibel distance from max power set at factory calibration. 0 is max power. Monotonically nondecreasing with lower power levels. IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from one milliwatt (dBm) Transmit power expressed as dBm (decibels from a 1 milliwatt reference). This is the absolute power level measured at the antenna port. IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index Unitless indication of the Rx/Tx antenna for this packet. The first antenna is antenna 0. IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB) RF signal power at the antenna, decibel difference from an arbitrary, fixed reference. IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB) RF noise power at the antenna, decibel difference from an arbitrary, fixed reference point. IEEE80211_RADIOTAP_RX_FLAGS u_int16_t bitmap Properties of received frames. Indicates that the flags bitmaps have been extended Specifies the reasons why a station may have been disassociated or deauthenticated by an access point. No reason was given. The reason was not specified. The previous authentication was no longer valid. The station is leaving (or has left) the IBSS or ESS. The station has been disassociated due to inactivity. The access point is unable to handle anymore associated stations. The station needs to be authenticated. The station needs to be associated. The station is leaving the BSS. Association is invalid because the station is not authenticated. The Power Capability information is unacceptable. The Supported Channels information is unacceptable. An invalid information element has been provided. The message integrity check failed. The 4way handshake has timed out. The Group Key handshake has timed out. An information element in the 4way handshake differs from in previous management frames. The group cipher is invalid. The pairwise cipher is invalid. The Authentication Key Managment Protocol is invalid. The provided RSN information element version is unsupported. The provided RSN information element capabilities are invalid. There has been an IEEE 802.1X authentication failure. The cipher suite has been rejected due to the security policy. The station has been disassociated due to an unspecified QoS related reason. The access point lacks sufficient bandwidth for the station. An excessive number of frames have failed to be acknowledged due to poor channel conditions. The station is transmitting outside the limits of its TXOPs. Disassociation was requested by the station as it is leaving the BSS. Disassociation was requested by the station as it is no longer wants to use the mechanism. Disassociation was requested by the station as it requires setup to use the mechanism. Disassociation was requested by the station due to a timeout. The station does not support the cipher suite. RTS Frame has a ReceiverAddress[6], TransmitterAddress[6] and a FrameCheckSequence[4], these fields follow the common FrameControl[2] and DurationId[2] fields Constructor A ReceiverAddress TransmitterAddress Length of the frame Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. The Sequence control field occurs in management and data frames and is used to relate together fragmented payloads carried in multiple 802.11 frames. Initializes a new instance of the class. Constructor A Gets or sets the field that backs all the other properties in the class. The field. Gets or sets the sequence number. The sequence number. Gets or sets the fragment number. The fragment number. Base class for IPv4 and IPv6 packets that exports the common functionality that both of these classes has in common IpPacket constructor The default time to live value for Ip packets being constructed Payload packet, overridden to set the NextHeader/Protocol based on the type of payload packet when the payload packet is set The destination address The source address The IP version The protocol of the ip packet's payload Named 'Protocol' in IPv4 Named 'NextHeader' in IPv6' The protocol of the ip packet's payload Included along side Protocol for user convienence The number of hops remaining before this packet is discarded Named 'TimeToLive' in IPv4 Named 'HopLimit' in IPv6 The number of hops remaining for this packet Included along side of TimeToLive for user convienence ipv4 header length field, calculated for ipv6 packets NOTE: This field is the number of 32bit words in the ip header, ie. the number of bytes is 4x this value ipv4 total number of bytes in the ipv4 header + payload, ipv6 PayloadLength + IPv6Fields.HeaderLength ipv6 payload length in bytes, calculate from ipv4.TotalLength - (ipv4.HeaderLength * 4) Adds a pseudo ip header to a given packet. Used to generate the full byte array required to generate a udp or tcp checksum. A A Convert an ip address from a byte[] A A A A Called by IPv4 and IPv6 packets to parse their packet payload A A A A Returns the IpPacket inside of the Packet p or null if there is no encapsulated packet A A Generate a random packet of a specific ip version A A Base class for all packet types. Defines helper methods and accessors for the architecture that underlies how packets interact and store their data. Constructor Returns true if we already have a contiguous byte[] in either of these conditions: - This packet's header byte[] and payload byte[] are the same instance or - This packet's header byte[] and this packet's payload packet are the same instance and the offsets indicate that the bytes are contiguous The packet that is carrying this one Returns a Packet that this packet carries if one is present. Note that the packet MAY have a null PayloadPacket but a non-null PayloadData Payload byte[] if one is present. Note that the packet MAY have a null PayloadData but a non-null PayloadPacket byte[] containing this packet and its payload NOTE: Use 'public virtual ByteArraySegment BytesHighPerformance' for highest performance The option to return a ByteArraySegment means that this method is higher performance as the data can start at an offset other than the first byte. Color used when generating the text description of a packet Parse bytes into a packet A A A Used to ensure that values like checksums and lengths are properly updated Called to ensure that calculated values are updated before the packet bytes are retrieved Classes should override this method to update things like checksums and lengths that take too much time or are too complex to update for each packet parameter change Output this packet as a readable string Output the packet information in the specified format Normal - outputs the packet info to a single line Colored - outputs the packet info to a single line with coloring Verbose - outputs detailed info about the packet VerboseColored - outputs detailed info about the packet with coloring Prints the Packet PayloadData in Hex format With the 16-byte segment number, raw bytes, and parsed ascii output Ex: 0010 00 18 82 6c 7c 7f 00 c0 9f 77 a3 b0 88 64 11 00 ...1|... .w...d.. A Session layer packet Constructor TcpPacket See: http://en.wikipedia.org/wiki/Transmission_Control_Protocol Create a new TCP packet from values Constructor A Constructor A A 20 bytes is the smallest tcp header Fetch the port number on the source host. Fetches the port number on the destination host. Fetch the packet sequence number. Fetch the packet acknowledgment number. The size of the tcp header in 32bit words The size of the receive window, which specifies the number of bytes (beyond the sequence number in the acknowledgment field) that the receiver is currently willing to receive. Tcp checksum field value of type UInt16 Check if the TCP packet is valid, checksum-wise. True if the tcp checksum is valid Flags, 9 bits TODO: Handle the NS bit Check the URG flag, flag indicates if the urgent pointer is valid. Check the ACK flag, flag indicates if the ack number is valid. Check the PSH flag, flag indicates the receiver should pass the data to the application as soon as possible. Check the RST flag, flag indicates the session should be reset between the sender and the receiver. Check the SYN flag, flag indicates the sequence numbers should be synchronized between the sender and receiver to initiate a connection. Check the FIN flag, flag indicates the sender is finished sending. ECN flag CWR flag Fetch ascii escape sequence of the color associated with this packet type. Fetch the urgent pointer. Bytes that represent the tcp options A Contains the Options list attached to the TCP header Computes the TCP checksum. Does not update the current checksum value The calculated TCP checksum. Update the checksum value. Returns the TcpPacket embedded in Packet p or null if there is no embedded TcpPacket Create a randomized tcp packet with the given ip version A User datagram protocol See http://en.wikipedia.org/wiki/Udp Create from values A A Constructor A Constructor A A Fetch the port number on the source host. Fetch the port number on the target host. Length in bytes of the header and payload, minimum size of 8, the size of the Udp header Fetch the header checksum. Check if the UDP packet is valid, checksum-wise. True if the udp checksum is valid Fetch ascii escape sequence of the color associated with this packet type. Update the Udp length Calculates the UDP checksum, optionally updating the UDP checksum header. The calculated UDP checksum. Update the checksum value. Returns the UdpPacket inside of the Packet p or null if there is no encapsulated packet A A Generate a random packet A Ethernet protocol field encoding information. Width of the ethernet type code in bytes. Position of the destination MAC address within the ethernet header. Position of the source MAC address within the ethernet header. Position of the ethernet type field within the ethernet header. Total length of an ethernet header in bytes. size of an ethernet mac address in bytes Transport layer packet Constructor Options for use when creating a transport layer checksum No extra options Attach a pseudo IP header to the transport data being checksummed The Checksum version Calculates the transport layer checksum, either for the tcp or udp packet A Determine if the transport layer checksum is valid A A String constants for color console output.

This file contains control sequences to print color text on a text console capable of interpreting and displaying control sequences.

A capable console would be unix bash, os/2 shell, or command.com w/ ansi.sys loaded

Chris Cheetham Delimits the start of an ansi color sequence, the color code goes after this Delimits the stop of the ansi color sequence, the color code comes before this Defines the lengths and positions of the udp fields within a udp packet Length of a UDP port in bytes. Length of the header length field in bytes. Length of the checksum field in bytes. Position of the source port. Position of the destination port. Position of the header length. Position of the header checksum length. Length of a UDP header in bytes. Equivalent of System.IO.BinaryReader, but with either endianness, depending on the EndianBitConverter it is constructed with. No data is buffered in the reader; the client may seek within the stream at will. Equivalent of System.IO.BinaryWriter, but with either endianness, depending on the EndianBitConverter it is constructed with. Converter to use when reading data Stream to read data from Constructs a new binary reader with the given bit converter, reading to the given stream, using the given encoding. Converter to use when reading data Stream to read data from Encoding to use when reading character data Whether or not this reader has been disposed yet. Decoder to use for string conversions. Buffer used for temporary storage before conversion into primitives Buffer used for temporary storage when reading a single character Minimum number of bytes used to encode a character The bit converter used to read values from the stream The encoding used to read strings Gets the underlying stream of the EndianBinaryReader. Closes the reader, including the underlying stream.. Seeks within the stream. Offset to seek to. Origin of seek operation. Reads a single byte from the stream. The byte read Reads a single signed byte from the stream. The byte read Reads a boolean from the stream. 1 byte is read. The boolean read Reads a 16-bit signed integer from the stream, using the bit converter for this reader. 2 bytes are read. The 16-bit integer read Reads a 32-bit signed integer from the stream, using the bit converter for this reader. 4 bytes are read. The 32-bit integer read Reads a 64-bit signed integer from the stream, using the bit converter for this reader. 8 bytes are read. The 64-bit integer read Reads a 16-bit unsigned integer from the stream, using the bit converter for this reader. 2 bytes are read. The 16-bit unsigned integer read Reads a 32-bit unsigned integer from the stream, using the bit converter for this reader. 4 bytes are read. The 32-bit unsigned integer read Reads a 64-bit unsigned integer from the stream, using the bit converter for this reader. 8 bytes are read. The 64-bit unsigned integer read Reads a single-precision floating-point value from the stream, using the bit converter for this reader. 4 bytes are read. The floating point value read Reads a double-precision floating-point value from the stream, using the bit converter for this reader. 8 bytes are read. The floating point value read Reads a decimal value from the stream, using the bit converter for this reader. 16 bytes are read. The decimal value read Reads a single character from the stream, using the character encoding for this reader. If no characters have been fully read by the time the stream ends, -1 is returned. The character read, or -1 for end of stream. Reads the specified number of characters into the given buffer, starting at the given index. The buffer to copy data into The first index to copy data into The number of characters to read The number of characters actually read. This will only be less than the requested number of characters if the end of the stream is reached. Reads the specified number of bytes into the given buffer, starting at the given index. The buffer to copy data into The first index to copy data into The number of bytes to read The number of bytes actually read. This will only be less than the requested number of bytes if the end of the stream is reached. Reads the specified number of bytes, returning them in a new byte array. If not enough bytes are available before the end of the stream, this method will return what is available. The number of bytes to read The bytes read Reads the specified number of bytes, returning them in a new byte array. If not enough bytes are available before the end of the stream, this method will throw an IOException. The number of bytes to read The bytes read Reads a 7-bit encoded integer from the stream. This is stored with the least significant information first, with 7 bits of information per byte of value, and the top bit as a continuation flag. This method is not affected by the endianness of the bit converter. The 7-bit encoded integer read from the stream. Reads a 7-bit encoded integer from the stream. This is stored with the most significant information first, with 7 bits of information per byte of value, and the top bit as a continuation flag. This method is not affected by the endianness of the bit converter. The 7-bit encoded integer read from the stream. Reads a length-prefixed string from the stream, using the encoding for this reader. A 7-bit encoded integer is first read, which specifies the number of bytes to read from the stream. These bytes are then converted into a string with the encoding for this reader. The string read from the stream. Checks whether or not the reader has been disposed, throwing an exception if so. Reads the given number of bytes from the stream, throwing an exception if they can't all be read. Buffer to read into Number of bytes to read Reads the given number of bytes from the stream if possible, returning the number of bytes actually read, which may be less than requested if (and only if) the end of the stream is reached. Buffer to read into Number of bytes to read Number of bytes actually read Disposes of the underlying stream. Equivalent of System.IO.BinaryWriter, but with either endianness, depending on the EndianBitConverter it is constructed with. Constructs a new binary writer with the given bit converter, writing to the given stream, using UTF-8 encoding. Converter to use when writing data Stream to write data to Constructs a new binary writer with the given bit converter, writing to the given stream, using the given encoding. Converter to use when writing data Stream to write data to Encoding to use when writing character data Whether or not this writer has been disposed yet. Buffer used for temporary storage during conversion from primitives Buffer used for Write(char) The bit converter used to write values to the stream The encoding used to write strings Gets the underlying stream of the EndianBinaryWriter. Closes the writer, including the underlying stream. Flushes the underlying stream. Seeks within the stream. Offset to seek to. Origin of seek operation. Writes a boolean value to the stream. 1 byte is written. The value to write Writes a 16-bit signed integer to the stream, using the bit converter for this writer. 2 bytes are written. The value to write Writes a 32-bit signed integer to the stream, using the bit converter for this writer. 4 bytes are written. The value to write Writes a 64-bit signed integer to the stream, using the bit converter for this writer. 8 bytes are written. The value to write Writes a 16-bit unsigned integer to the stream, using the bit converter for this writer. 2 bytes are written. The value to write Writes a 32-bit unsigned integer to the stream, using the bit converter for this writer. 4 bytes are written. The value to write Writes a 64-bit unsigned integer to the stream, using the bit converter for this writer. 8 bytes are written. The value to write Writes a single-precision floating-point value to the stream, using the bit converter for this writer. 4 bytes are written. The value to write Writes a double-precision floating-point value to the stream, using the bit converter for this writer. 8 bytes are written. The value to write Writes a decimal value to the stream, using the bit converter for this writer. 16 bytes are written. The value to write Writes a signed byte to the stream. The value to write Writes an unsigned byte to the stream. The value to write Writes an array of bytes to the stream. The values to write Writes a portion of an array of bytes to the stream. An array containing the bytes to write The index of the first byte to write within the array The number of bytes to write Writes a single character to the stream, using the encoding for this writer. The value to write Writes an array of characters to the stream, using the encoding for this writer. An array containing the characters to write Writes a string to the stream, using the encoding for this writer. The value to write. Must not be null. value is null Writes a 7-bit encoded integer from the stream. This is stored with the least significant information first, with 7 bits of information per byte of value, and the top bit as a continuation flag. The 7-bit encoded integer to write to the stream Checks whether or not the writer has been disposed, throwing an exception if so. Writes the specified number of bytes from the start of the given byte array, after checking whether or not the writer has been disposed. The array of bytes to write from The number of bytes to write Disposes of the underlying stream. Implementation of EndianBitConverter which converts to/from big-endian byte arrays. Indicates the byte order ("endianess") in which data is converted using this class. Indicates the byte order ("endianess") in which data is converted using this class. Different computer architectures store data using different byte orders. "Big-endian" means the most significant byte is on the left end of a word. "Little-endian" means the most significant byte is on the right end of a word. true if this converter is little-endian, false otherwise. Copies the specified number of bytes from value to buffer, starting at index. The value to copy The number of bytes to copy The buffer to copy the bytes into The index to start at Returns a value built from the specified number of bytes from the given buffer, starting at index. The data in byte array format The first index to use The number of bytes to use The value built from the given bytes A class to allow the conversion of doubles to string representations of their exact decimal values. The implementation aims for readability over efficiency. Private class used for manipulating sequences of decimal digits. Constructs an arbitrary decimal expansion from the given long. The long must not be negative. Digits in the decimal expansion, one byte per digit How many digits are *after* the decimal point Multiplies the current expansion by the given amount, which should only be 2 or 5. Shifts the decimal point; a negative value makes the decimal expansion bigger (as fewer digits come after the decimal place) and a positive value makes the decimal expansion smaller. Removes leading/trailing zeroes from the expansion. Converts the value to a proper decimal string representation. Converts the given double to a string representation of its exact decimal value. The double to convert. A string representation of the double's exact decimal value. Equivalent of System.BitConverter, but with either endianness. Union used solely for the equivalent of DoubleToInt64Bits and vice versa. Creates an instance representing the given integer. The integer value of the new instance. Creates an instance representing the given floating point number. The floating point value of the new instance. Int32 version of the value. Single version of the value. Returns the value of the instance as an integer. Returns the value of the instance as a floating point number. Indicates the byte order ("endianess") in which data is converted using this class. Returns a little-endian bit converter instance. The same instance is always returned. Returns a big-endian bit converter instance. The same instance is always returned. Indicates the byte order ("endianess") in which data is converted using this class. Different computer architectures store data using different byte orders. "Big-endian" means the most significant byte is on the left end of a word. "Little-endian" means the most significant byte is on the right end of a word. true if this converter is little-endian, false otherwise. Converts the specified double-precision floating point number to a 64-bit signed integer. Note: the endianness of this converter does not affect the returned value. The number to convert. A 64-bit signed integer whose value is equivalent to value. Converts the specified 64-bit signed integer to a double-precision floating point number. Note: the endianness of this converter does not affect the returned value. The number to convert. A double-precision floating point number whose value is equivalent to value. Converts the specified single-precision floating point number to a 32-bit signed integer. Note: the endianness of this converter does not affect the returned value. The number to convert. A 32-bit signed integer whose value is equivalent to value. Converts the specified 32-bit signed integer to a single-precision floating point number. Note: the endianness of this converter does not affect the returned value. The number to convert. A single-precision floating point number whose value is equivalent to value. Returns a Boolean value converted from one byte at a specified position in a byte array. An array of bytes. The starting position within value. true if the byte at startIndex in value is nonzero; otherwise, false. Returns a Unicode character converted from two bytes at a specified position in a byte array. An array of bytes. The starting position within value. A character formed by two bytes beginning at startIndex. Returns a double-precision floating point number converted from eight bytes at a specified position in a byte array. An array of bytes. The starting position within value. A double precision floating point number formed by eight bytes beginning at startIndex. Returns a single-precision floating point number converted from four bytes at a specified position in a byte array. An array of bytes. The starting position within value. A single precision floating point number formed by four bytes beginning at startIndex. Returns a 16-bit signed integer converted from two bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 16-bit signed integer formed by two bytes beginning at startIndex. Returns a 32-bit signed integer converted from four bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 32-bit signed integer formed by four bytes beginning at startIndex. Returns a 64-bit signed integer converted from eight bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 64-bit signed integer formed by eight bytes beginning at startIndex. Returns a 16-bit unsigned integer converted from two bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 16-bit unsigned integer formed by two bytes beginning at startIndex. Returns a 32-bit unsigned integer converted from four bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 32-bit unsigned integer formed by four bytes beginning at startIndex. Returns a 64-bit unsigned integer converted from eight bytes at a specified position in a byte array. An array of bytes. The starting position within value. A 64-bit unsigned integer formed by eight bytes beginning at startIndex. Checks the given argument for validity. The byte array passed in The start index passed in The number of bytes required value is a null reference startIndex is less than zero or greater than the length of value minus bytesRequired. Checks the arguments for validity before calling FromBytes (which can therefore assume the arguments are valid). The bytes to convert after checking The index of the first byte to convert The number of bytes to convert Convert the given number of bytes from the given array, from the given start position, into a long, using the bytes as the least significant part of the long. By the time this is called, the arguments have been checked for validity. The bytes to convert The index of the first byte to convert The number of bytes to use in the conversion The converted number Returns a String converted from the elements of a byte array. An array of bytes. All the elements of value are converted. A String of hexadecimal pairs separated by hyphens, where each pair represents the corresponding element in value; for example, "7F-2C-4A". Returns a String converted from the elements of a byte array starting at a specified array position. An array of bytes. The starting position within value. The elements from array position startIndex to the end of the array are converted. A String of hexadecimal pairs separated by hyphens, where each pair represents the corresponding element in value; for example, "7F-2C-4A". Returns a String converted from a specified number of bytes at a specified position in a byte array. An array of bytes. The starting position within value. The number of bytes to convert. The length elements from array position startIndex are converted. A String of hexadecimal pairs separated by hyphens, where each pair represents the corresponding element in value; for example, "7F-2C-4A". Returns a decimal value converted from sixteen bytes at a specified position in a byte array. An array of bytes. The starting position within value. A decimal formed by sixteen bytes beginning at startIndex. Returns the specified decimal value as an array of bytes. The number to convert. An array of bytes with length 16. Copies the specified decimal value into the specified byte array, beginning at the specified index. A character to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Returns an array with the given number of bytes formed from the least significant bytes of the specified value. This is used to implement the other GetBytes methods. The value to get bytes for The number of significant bytes to return Returns the specified Boolean value as an array of bytes. A Boolean value. An array of bytes with length 1. Returns the specified Unicode character value as an array of bytes. A character to convert. An array of bytes with length 2. Returns the specified double-precision floating point value as an array of bytes. The number to convert. An array of bytes with length 8. Returns the specified 16-bit signed integer value as an array of bytes. The number to convert. An array of bytes with length 2. Returns the specified 32-bit signed integer value as an array of bytes. The number to convert. An array of bytes with length 4. Returns the specified 64-bit signed integer value as an array of bytes. The number to convert. An array of bytes with length 8. Returns the specified single-precision floating point value as an array of bytes. The number to convert. An array of bytes with length 4. Returns the specified 16-bit unsigned integer value as an array of bytes. The number to convert. An array of bytes with length 2. Returns the specified 32-bit unsigned integer value as an array of bytes. The number to convert. An array of bytes with length 4. Returns the specified 64-bit unsigned integer value as an array of bytes. The number to convert. An array of bytes with length 8. Copies the given number of bytes from the least-specific end of the specified value into the specified byte array, beginning at the specified index. This is used to implement the other CopyBytes methods. The value to copy bytes for The number of significant bytes to copy The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the given number of bytes from the least-specific end of the specified value into the specified byte array, beginning at the specified index. This must be implemented in concrete derived classes, but the implementation may assume that the value will fit into the buffer. The value to copy bytes for The number of significant bytes to copy The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified Boolean value into the specified byte array, beginning at the specified index. A Boolean value. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified Unicode character value into the specified byte array, beginning at the specified index. A character to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified double-precision floating point value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 16-bit signed integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 32-bit signed integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 64-bit signed integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified single-precision floating point value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 16-bit unsigned integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 32-bit unsigned integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Copies the specified 64-bit unsigned integer value into the specified byte array, beginning at the specified index. The number to convert. The byte array to copy the bytes into The first index into the array to copy the bytes into Endianness of a converter Little endian - least significant byte first Big endian - most significant byte first Implementation of EndianBitConverter which converts to/from little-endian byte arrays. Indicates the byte order ("endianess") in which data is converted using this class. Indicates the byte order ("endianess") in which data is converted using this class. Different computer architectures store data using different byte orders. "Big-endian" means the most significant byte is on the left end of a word. "Little-endian" means the most significant byte is on the right end of a word. true if this converter is little-endian, false otherwise. Copies the specified number of bytes from value to buffer, starting at index. The value to copy The number of bytes to copy The buffer to copy the bytes into The index to start at Returns a value built from the specified number of bytes from the given buffer, starting at index. The data in byte array format The first index to use The number of bytes to use The value built from the given bytes Internet packets include IPv4, IPv6, IGMP etc, see http://en.wikipedia.org/wiki/Internet_Layer Constructor IP protocol field encoding information. Width of the IP version and header length field in bytes. Width of the Differentiated Services / Type of service field in bytes. Width of the total length field in bytes. Width of the ID field in bytes. Width of the fragment offset bits and offset field in bytes. Width of the TTL field in bytes. Width of the IP protocol code in bytes. Width of the IP checksum in bytes. Position of the version code and header length within the IP header. Position of the differentiated services value within the IP header. Position of the header length within the IP header. Position of the packet ID within the IP header. Position of the flag bits and fragment offset within the IP header. Position of the ttl within the IP header. Position of the protocol used within the IP data Position of the checksum within the IP header. Position of the source IP address within the IP header. Position of the destination IP address within a packet. Length in bytes of an IP header, excluding options. Number of bytes in an IPv4 address IPv4 packet See http://en.wikipedia.org/wiki/IPv4 for into Construct an instance by values Constructor A Type of service code constants for IP. Type of service describes how a packet should be handled.

TOS is an 8-bit record in an IP header which contains a 3-bit precendence field, 4 TOS bit fields and a 0 bit.

The following constants are bit masks which can be logically and'ed with the 8-bit IP TOS field to determine what type of service is set.

Taken from TCP/IP Illustrated V1 by Richard Stevens, p34.

Number of bytes in the smallest valid ipv4 packet Version number of the IP protocol being used Get the IP version code. Forwards compatibility IPv6.PayloadLength property The IP header length field. At most, this can be a four-bit value. The high order bits beyond the fourth bit will be ignored. The length of the IP header in 32-bit words. The unique ID of this IP datagram. The ID normally increments by one each time a datagram is sent by a host. A 16-bit unsigned integer. Fragmentation offset The offset specifies a number of octets (i.e., bytes). A 13-bit unsigned integer. Fetch the IP address of the host where the packet originated from. Fetch the IP address of the host where the packet is destined. Fetch the header checksum. Check if the IP packet is valid, checksum-wise. Check if the IP packet header is valid, checksum-wise. Fetch ascii escape sequence of the color associated with this packet type. Fetch the type of service. Renamed to DifferentiatedServices in IPv6 but present here for backwards compatibility The entire datagram size including header and data Fetch fragment flags. A 3-bit unsigned integer. Fetch the time to live. TTL sets the upper limit on the number of routers through which this IP datagram is allowed to pass. Originally intended to be the number of seconds the packet lives it is now decremented by one each time a router passes the packet on 8-bit value Fetch the code indicating the type of protocol embedded in the IP Calculates the IP checksum, optionally updating the IP checksum header. The calculated IP checksum. Update the checksum value Prepend to the given byte[] origHeader the portion of the IPv6 header used for generating an tcp checksum http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_checksum_using_IPv4 http://tools.ietf.org/html/rfc793 A A Generate a random packet A Update the length fields A struct containing length and position information about IPv6 Fields. Commutes the field positions. The IP Version, Traffic Class, and Flow Label field length. These must be in one field due to boundary crossings. The payload length field length. The next header field length, identifies protocol encapsulated by the packet The hop limit field length. Address field length The byte position of the field line in the IPv6 header. This is where the IP version, Traffic Class, and Flow Label fields are. The byte position of the payload length field. The byte position of the next header field. (Replaces the ipv4 protocol field) The byte position of the hop limit field. The byte position of the source address field. The byte position of the destination address field. The byte length of the IPv6 Header IPv6 packet References ---------- http://tools.ietf.org/html/rfc2460 http://en.wikipedia.org/wiki/IPv6 Create an IPv6 packet from values A A Constructor A Minimum number of bytes in an IPv6 header The version of the IP protocol. The '6' in IPv6 indicates the version of the protocol The version field of the IPv6 Packet. The traffic class field of the IPv6 Packet. The flow label field of the IPv6 Packet. The payload lengeth field of the IPv6 Packet NOTE: Differs from the IPv4 'Total length' field that includes the length of the header as payload length is ONLY the size of the payload. Backwards compatibility property for IPv4.HeaderLength NOTE: This field is the number of 32bit words Backwards compatibility property for IPv4.TotalLength Identifies the protocol encapsulated by this packet Replaces IPv4's 'protocol' field, has compatible values The protocol of the packet encapsulated in this ip packet The hop limit field of the IPv6 Packet. NOTE: Replaces the 'time to live' field of IPv4 8-bit value Helper alias for 'HopLimit' The source address field of the IPv6 Packet. The destination address field of the IPv6 Packet. Fetch ascii escape sequence of the color associated with this packet type. Prepend to the given byte[] origHeader the portion of the IPv6 header used for generating an tcp checksum http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_checksum_using_IPv6 http://tools.ietf.org/html/rfc2460#page-27 A A Generate a random packet A Code constants for ip ports. Secure shell Terminal protocol Simple mail transport protocol Hyper text transfer protocol Same as Http Secure ftp Network time protocol Simple network management protocol Computes the one's sum on a byte array. Based TCP/IP Illustrated Vol. 2(1995) by Gary R. Wright and W. Richard Stevens. Page 236. And on http://www.cs.utk.edu/~cs594np/unp/checksum.html Computes the one's complement sum on a byte array Computes the one's complement sum on a byte array Compute a ones sum of a byte array A A 16 bit sum of all values http://en.wikipedia.org/wiki/Signed_number_representations#Ones.27_complement A A A A IP protocol field encoding information. Length of a TCP port in bytes. Length of the sequence number in bytes. Length of the acknowledgment number in bytes. Length of the data offset and flags field in bytes. The length of the flags field Length of the window size field in bytes. Length of the checksum field in bytes. Length of the urgent field in bytes. Position of the source port field. Position of the destination port field. Position of the sequence number field. Position of the acknowledgment number field. Position of the data offset Position of the flags field Position of the window size field. Position of the checksum field. Position of the urgent pointer field. Length in bytes of a TCP header. IP protocol field encoding information. FIXME: These fields are partially broken because they assume the offset for several fields and the offset is actually based on the accumulated offset into the structure determined by the fields that indicate sizes Type code for ethernet addresses. Type code for MAC addresses. Operation type length in bytes. The length of the address type fields in bytes, eg. the length of hardware type or protocol type The length of the address length fields in bytes. Position of the hardware address type. Position of the protocol address type. Position of the hardware address length. Position of the protocol address length. Position of the operation type. Position of the sender hardware address. Position of the sender protocol address. Position of the target hardware address. Position of the target protocol address. Total length in bytes of an ARP header. An ARP protocol packet. Create an ARPPacket from values A A A A A Constructor A Also known as HardwareType Also known as ProtocolType Hardware address length field Protocol address length field Fetch the operation code. Usually one of ARPFields.{ARP_OP_REQ_CODE, ARP_OP_REP_CODE}. Sets the operation code. Usually one of ARPFields.{ARP_OP_REQ_CODE, ARP_OP_REP_CODE}. Upper layer protocol address of the sender, arp is used for IPv4, IPv6 uses NDP Upper layer protocol address of the target, arp is used for IPv4, IPv6 uses NDP Sender hardware address, usually an ethernet mac address Target hardware address, usually an ethernet mac address Fetch ascii escape sequence of the color associated with this packet type. Returns the encapsulated ARPPacket of the Packet p or null if there is no encapsulated packet A A ICMP protocol field encoding information. See http://en.wikipedia.org/wiki/ICMPv6 Length of the ICMP message type code in bytes. Length of the ICMP subcode in bytes. Length of the ICMP header checksum in bytes. Position of the ICMP message type. Position of the ICMP message subcode. Position of the ICMP header checksum. Length in bytes of an ICMP header. An ICMP packet. See http://en.wikipedia.org/wiki/ICMPv6 Constructor A Constructor with parent packet A A Used to prevent a recursive stack overflow when recalculating in UpdateCalculatedValues() The Type value Fetch the ICMP code Checksum value Fetch ascii escape sequence of the color associated with this packet type. Recalculate the checksum Returns the ICMPv6Packet inside of Packet p or null if there is no encapsulated ICMPv6Packet A A Code constants for IGMP message types. From RFC #2236. An IGMP packet. Constructor A Constructor with parent A A The type of IGMP message Fetch the IGMP max response time. Fetch the IGMP header checksum. Fetch the IGMP group address. Fetch ascii escape sequence of the color associated with this packet type. Returns the encapsulated IGMPv2Packet of the Packet p or null if there is no encapsulated packet A A Internet Link layer packet See http://en.wikipedia.org/wiki/Link_Layer Constructor Look for the innermost payload. This method is useful because while some packets are LinuxSSL->IpPacket or EthernetPacket->IpPacket, there are some packets that are EthernetPacket->PPPoEPacket->PPPPacket->IpPacket, and for these cases we really want to get to the IpPacket A IGMP protocol field encoding information. Length of the IGMP message type code in bytes. Length of the IGMP max response code in bytes. Length of the IGMP header checksum in bytes. Length of group address in bytes. Position of the IGMP message type. Position of the IGMP max response code. Position of the IGMP header checksum. Position of the IGMP group address. Length in bytes of an IGMP header. Represents a Linux cooked capture packet, the kinds of packets received when capturing on an 'any' device See http://github.com/mcr/libpcap/blob/master/pcap/sll.h Constructor A Information about the packet direction The Number of bytes in the link layer address of the sender of the packet Link layer header bytes, maximum of 8 bytes The encapsulated protocol type Lengths and offsets to the fields in the LinuxSLL packet See http://github.com/mcr/libpcap/blob/master/pcap/sll.h Length of the packet type field Link layer address type Link layer address length The link layer address field length NOTE: the actual link layer address MAY be shorter than this Number of bytes in a SLL header Length of the ethernet protocol field Position of the packet type field Position of the link layer address type field Positino of the link layer address length field Position of the link layer address field Position of the ethernet protocol type field The types of cooked packets See http://github.com/mcr/libpcap/blob/master/pcap/sll.h Packet was sent to us by somebody else Packet was broadcast by somebody else Packet was multicast, but not broadcast Packet was sent by somebody else to somebody else Packet was sent by us The protocol encapsulated inside of the IP packet Dummy protocol for TCP. IPv6 Hop-by-Hop options. Internet Control Message Protocol. Internet Group Management Protocol. IPIP tunnels (older KA9Q tunnels use 94). Transmission Control Protocol. Exterior Gateway Protocol. PUP protocol. User Datagram Protocol. XNS IDP protocol. SO Transport Protocol Class 4. IPv6 header. IPv6 routing header. IPv6 fragmentation header. Reservation Protocol. General Routing Encapsulation. encapsulating security payload. authentication header. ICMPv6. IPv6 no next header. IPv6 destination options. Multicast Transport Protocol. Encapsulation Header. Protocol Independent Multicast. Compression Header Protocol. Raw IP packets. IP protocol mask. Code constants for internet protocol versions. Internet protocol version 4. Internet protocol version 6. Link-layer type codes.

Taken from libpcap/bpf/net/bpf.h and pcap/net/bpf.h.

The link-layer type is used to determine what data-structure the IP protocol bits will be encapsulated inside of.

On a 10/100mbps network, packets are encapsulated inside of ethernet. 14-byte ethernet headers which contain MAC addresses and an ethernet type field.

On ethernet over ppp, the link-layer type is raw, and packets are not encapsulated in any ethernet header.

no link-layer encapsulation Ethernet (10Mb) Experimental Ethernet (3Mb) Amateur Radio AX.25 Proteon ProNET Token Ring Chaos IEEE 802 Networks ARCNET Serial Line IP Point-to-point Protocol FDDI LLC/SNAP encapsulated atm raw IP BSD Slip. BSD PPP. IP over ATM. PPP over HDLC. Cisco HDLC. IEEE 802.11 wireless. OpenBSD loopback. Linux cooked sockets. Header for 802.11 plus a number of bits of link-layer information including radio information, used by some recent BSD drivers as well as the madwifi Atheros driver for Linux. Per Packet Information encapsulated packets. DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. See http://www.cacetech.com/documents/PPI%20Header%20format%201.0.7.pdf Helper class that prints out an array of hex values Create a string that contains the hex values of byte[] Byte in text form A A A A Creates a string from a Physical address in the format "xx:xx:xx:xx:xx:xx" A A Random utility methods Generate a random ip address A A Differentiates between a packet class payload, a byte[] payload or no payload ICMPv6 types, see http://en.wikipedia.org/wiki/ICMPv6 and http://www.iana.org/assignments/icmpv6-parameters The possible ARP operation values References: - http://www.networksorcery.com/enp/default1101.htm Request See RFC 826, RFC 5227 Response See RFC 826, RFC 1868, RFC 5227 Request Reverse See RFC 903 Reply Reverse See RFC 903 DRARP Request See RFC 1931 DRARP Reply See RFC 1931 DRARP Error See RFC 1931 InARP Request See RFC 1293 InARP Reply See RFC 1293 ARP NAK See RFC 1577 MARS Request MARS Multi MARS MServ MARS Join MARS Leave MARS NAK MARS Unserv MARS SJoin MARS SLeave MARS Grouplist Request MARS Grouplist Reply MARS Redirect Map MARS UNARP See RFC 2176 OP_EXP1 See RFC 5494 OP_EXP2 Point to Point Protocol See http://tools.ietf.org/html/rfc2516 Construct a new PPPoEPacket from source and destination mac addresses Constructor A PPPoe version, must be 0x1 according to RFC FIXME: This currently outputs the wrong version number Type, must be 0x1 according to RFC FIXME: This currently outputs the wrong code Session identifier for this PPPoe packet Length of the PPPoe payload, not including the PPPoe header Fetch ascii escape sequence of the color associated with this packet type. Returns the encapsulated PPPoE of the Packet p or null if there is no encapsulated packet A A Generate a random PPPoEPacket A Point to Point Protocol See http://tools.ietf.org/html/rfc2516 Size in bytes of the version/type field Size in bytes of the code field Size in bytes of the SessionId field Size in bytes of the Length field Offset from the start of the header to the version/type field Offset from the start of the header to the Code field Offset from the start of the header to the SessionId field Offset from the start of the header to the Length field Length of the overall PPPoe header Values for the Code field of a PPPoE packet See http://tools.ietf.org/html/rfc2516 The PPPoe payload must contain a PPP packet Active Discovery Offer (PADO) packet From RFC2516: The Host sends the PADI packet with the DESTINATION_ADDR set to the broadcast address. The CODE field is set to 0x09 and the SESSION_ID MUST be set to 0x0000. The PADI packet MUST contain exactly one TAG of TAG_TYPE Service- Name, indicating the service the Host is requesting, and any number of other TAG types. An entire PADI packet (including the PPPoE header) MUST NOT exceed 1484 octets so as to leave sufficient room for a relay agent to add a Relay-Session-Id TAG. Indicate that the PPPoe session specified by the SessionId field of the PPPoe packet has been terminated PPP packet See http://en.wikipedia.org/wiki/Point-to-Point_Protocol Construct a new PPPPacket from source and destination mac addresses Constructor A See http://www.iana.org/assignments/ppp-numbers Fetch ascii escape sequence of the color associated with this packet type. Returns the encapsulated PPPPacket of the Packet p or null if there is no encapsulated packet A A Generate a random PPPoEPacket A The fields in a PPP packet See http://en.wikipedia.org/wiki/Point-to-Point_Protocol Length of the Protocol field in bytes, the field is of type PPPProtocol Offset from the start of the PPP packet where the Protocol field is located The length of the header Indicates the protocol encapsulated by the PPP packet See http://www.iana.org/assignments/ppp-numbers Padding IPv4 IPv6 Code constants for ICMP message types. From http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#List_of_permitted_control_messages_.28incomplete_list.29 Note that these values represent the combined type and code fields, where the type field is the upper byte ICMP protocol field encoding information. See http://en.wikipedia.org/wiki/ICMPv6 Length of the ICMP message type code in bytes. Length of the ICMP header checksum in bytes. Length of the ICMP ID field in bytes. Length of the ICMP Sequence field in bytes Position of the ICMP message type/code. Position of the ICMP header checksum. Position of the ICMP ID field Position of the Sequence field Length in bytes of an ICMP header. An ICMP packet See http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol Constructor A Construct with parent packet A A The Type/Code enum value Checksum value ID field Sequence field Contents of the ICMP packet Fetch ascii escape sequence of the color associated with this packet type. Returns the ICMPv4Packet inside of Packet p or null if there is no encapsulated ICMPv4Packet A A Container class that refers to a segment of bytes in a byte[] Used to ensure high performance by allowing memory copies to be avoided Constructor A Constructor from a byte array, offset into the byte array and a length beyond that offset of the bytes this class is referencing A A A Constructor A A A A Copy constructor A The byte[] array The maximum number of bytes we should treat Bytes as having, allows for controling the number of bytes produced by EncapsulatedBytes() Number of bytes beyond the offset into Bytes Offset into Bytes Return true if we need to perform a copy to get the bytes represented by this class A Returns a contiguous byte[] from this container, if necessary, by copying the bytes from the current offset into a newly allocated byte[]. NeedsCopyForActualBytes can be used to determine if the copy is necessary A Helper method that returns the segment immediately following this instance, useful for processing where the parent wants to pass the next segment to a sub class for processing A Create the segment after the current one A that can be used to limit the segment length of the ByteArraySegment that is to be returned. Often used to exclude trailing bytes. A Format the class information as a string A Encapsulates and ensures that we have either a Packet OR a ByteArraySegment but not both Whether or not this container contains a packet, a byte[] or neither Appends to the MemoryStream either the byte[] represented by TheByteArray, or if ThePacket is non-null, the Packet.Bytes will be appended to the memory stream which will append ThePacket's header and any encapsulated packets it contains A A LLDP packet. As specified in IEEE Std 802.1AB See http://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol for general info See IETF 802.1AB for the full specification Create an empty LLDPPacket Constructor A Contains the TLV's in the LLDPDU Allows access of the TlvCollection by index The index of the item being set/retrieved in the collection The requested TLV The current length of the LLDPDU LLDPPacket specific implementation of BytesHighPerformance Necessary because each TLV in the collection may have a byte[] that is not shared by other TLVs NOTE: There is potential for the same performance improvement that the Packet class uses where we check to see if each TLVs uses the same byte[] and that there are no gaps. Enables foreach functionality for this class The next item in the list Parse byte[] into TLVs A A A A Returns the LLDP inside of the Packet p or null if there is no encapsulated packet A A Create a randomized LLDP packet with some basic TLVs A The TLV Types See IETF RFC 802.1AB for more info Signifies the end of a LLDPU The End Of LLDPDU TLV is a 2-octet, all-zero TLV that is used to mark the end of the TLV sequence in LLDPDUs Source: IETF RFC 802.1AB A Chassis Identifier A mandatory TLV that identifies the chassis containing the IEEE 802 LAN station associated with the transmitting LLDP agent Source: IETF RFC 802.1AB A Port Identifier A mandatory TLV that identifies the port component of the MSAP identifier associated with the transmitting LLDP agent. Source: IETF RFC 802.1AB Specifies the Time to Live Indicates the number of seconds that the recipient LLDP agent is to regard the information associated with this MSAP identifier to be valid A value of 0 signals that this source is no longer available and all information associated with it should be deleted. Source: IETF RFC 802.1AB A Description of the Port The port description field shall contain an alpha-numeric string that indicates the port’s description. Source: IETF RFC 802.1AB The System's Assigned Name The System Name TLV allows network management to advertise the system’s assigned name. Source: IETF RFC 802.1AB A Description of the System The System Description TLV allows network management to advertise the system’s description Source: IETF RFC 802.1AB A bitmap containing the System's capabilities The System Capabilities TLV is an optional TLV that identifies the primary function(s) of the system and whether or not these primary functions are enabled. Source: IETF RFC 802.1AB The Management Address The Management Address TLV identifies an address associated with the local LLDP agent that may be used to reach higher layer entities to assist discovery by network management. Source: IETF RFC 802.1AB A vendor-specifid TLV This TLV category is provided to allow different organizations, such as IEEE 802.1, IEEE 802.3, IETF, as well as individual software and equipment vendors, to define TLVs that advertise information to remote entities attached to the same media. Source: IETF RFC 802.1AB The Chassis ID TLV subtypes A Chassis Component identifier See IETF RFC 2737 An Interface Alias identifier See IETF RFC 2863 A Port Component identifier See IETF RFC 2737 A MAC (Media Access Control) Address identifier See IEEE Std 802 A Network Address (IP Address) Identifier See IEEE Std 802 An Interface Name identifier See IEEE Std 802 A Locally Assigned identifier The Port ID TLV subtypes An Interface Alias identifier See IETF RFC 2863 A Port Component identifier See IETF RFC 2737 A MAC (Media Access Control) Address identifier See IEEE Std 802 A Network Address (IP Address) Identifier See IEEE Std 802 An Interface Name identifier See IEEE Std 802 An Agent Circiut ID identifier See IETF RFC 3046 A Locally Assigned identifier See IETF RFC 3046 The System Capabilities options An Other Type of System A Repeater See IETF RFC 2108 A Bridge IETF RFC 2674 A WLAN Access Point IEEE 802.11 MIB A Router IETF RFC 1812 A Telephone IETF RFC 2011 A DOCSIS Cable Device See IETF RFC 2669 See IETF RFC 2670 A Station with no other capabilities IETF RFC 2011 A Type-Length-Value object Create a tlv Creates a TLV Bytes that comprise the TLV The TLVs offset from the start of byte[] bytes Points to the TLV data Interface to this TLVs type and length Length of value portion of the TLV NOTE: Does not include the length of the Type and Length fields Total length of the TLV, including the length of the Type and Length fields Tlv type Offset to the value bytes of the TLV Return a byte[] that contains the tlv Points to the TLV data A Network Address Creates a Network Address entity The Network Address Create a network address from byte data A A A Length of AddressFamily field in bytes Number of bytes in the NetworkAddress The format of the Network Address The Network Address Equals override A A GetHashCode() override A ToString() override A Interface Numbering Types Source IETF RFC 802.1AB Unknown Interface Index System Port Number An End Of LLDPDU TLV Parses bytes into an End Of LLDPDU TLV TLV bytes The End Of LLDPDU TLV's offset from the origin of the LLDP Creates an End Of LLDPDU TLV Convert this TTL TLV to a string. A human readable string A Chassis ID TLV Creates a Chassis ID TLV by parsing a byte[] The Chassis ID TLV's offset from the origin of the LLDP Creates a Chassis ID TLV and sets it value The ChassisID subtype The subtype's value Create a ChassisID given a mac address A Create a ChassisID given an interface name http://tools.ietf.org/search/rfc2863 page 38 A Length of the sub type field in bytes The type of the TLV subtype The TLV subtype value If SubType is ChassisComponent If SubType is InterfaceName the interface name If SubType is MACAddress the mac address If SubType is NetworkAddress the network address If SubType is PortComponent If SubType is InterfaceAlias Helper method to reduce duplication in type specific constructors Convert this Chassis ID TLV to a string. A human readable string A Port ID TLV Creates a Port ID TLV The Port ID TLV's offset from the origin of the LLDP Creates a Port ID TLV and sets it value The Port ID SubType The subtype's value Construct a PortID from a NetworkAddress A The type of the TLV subtype The TLV subtype value Offset to the value field Size of the value field Helper method to reduce duplication in type specific constructors Convert this Port ID TLV to a string. A human readable string A Time to Live TLV Creates a TTL TLV The TTL TLV's offset from the origin of the LLDP Creates a TTL TLV and sets it value The length in seconds until the LLDP is refreshed Number of bytes in the value portion of this tlv The number of seconds until the LLDP needs to be refreshed A value of 0 means that the LLDP source is closed and should no longer be refreshed Convert this TTL TLV to a string. A human readable string A Port Description TLV Creates a Port Description TLV The Port Description TLV's offset from the origin of the LLDP Creates a Port Description TLV and sets it value A textual description of the port A textual Description of the port A System Name TLV Creates a System Name TLV The System Name TLV's offset from the origin of the LLDP Creates a System Name TLV and sets it value A textual Name of the system A textual Name of the system A System Description TLV Creates a System Description TLV The System Description TLV's offset from the origin of the LLDP Creates a System Description TLV and sets it value A textual Description of the system A textual Description of the system A System Capabilities TLV [TLVTypeLength - 2 bytes][System Capabilities - 2 bytes][Enabled Capabilities - 2 bytes] Creates a System Capabilities TLV The System Capabilities TLV's offset from the origin of the LLDP Creates a System Capabilities TLV and sets the value A bitmap containing the available System Capabilities A bitmap containing the enabled System Capabilities A bitmap containing the available System Capabilities A bitmap containing the Enabled System Capabilities Checks whether the system is capable of a certain function The capability being checked Whether or not the system is capable of the function being tested Checks whether the specified function has been enabled on the system The capability being checked Whether or not the specified function is enabled Convert this System Capabilities TLV to a string. A human readable string A Time to Live TLV [TLV Type Length : 2][Mgmt Addr length : 1][Mgmt Addr Subtype : 1][Mgmt Addr : 1-31] [Interface Subtype : 1][Interface number : 4][OID length : 1][OID : 0-128] Creates a Management Address TLV The LLDP Data unit being modified The Management Address TLV's offset from the origin of the LLDP Creates a Management Address TLV and sets it value The Management Address The Interface Numbering Sub Type The Interface Number The Object Identifier Number of bytes in the AddressLength field Number of bytes in the interface number subtype field Number of bytes in the interface number field Number of bytes in the object identifier length field Maximum number of bytes in the object identifier field The Management Address Length The Management Address Subtype Forward to the MgmtAddress instance The Management Address Interface Number Sub Type Interface Number Object ID Length Object ID Convert this Management Address TLV to a string. A human readable string An Organization Specific TLV [TLV Type Length : 2][Organizationally Unique Identifier OUI : 3] [Organizationally Defined Subtype : 1][Organizationally Defined Information String : 0 - 507] Creates an Organization Specific TLV The LLDP Data unit being modified The Organization Specific TLV's offset from the origin of the LLDP Creates an Organization Specific TLV and sets it value An Organizationally Unique Identifier An Organizationally Defined SubType An Organizationally Defined Information String An Organizationally Unique Identifier An Organizationally Defined SubType An Organizationally Defined Information String Convert this Organization Specific TLV to a string. A human readable string Tlv type and length are 2 bytes See http://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol#Frame_structure Construct a TLVTypeLength for a TLV A Length in bytes of the tlv type and length fields The TLV Value's Type The TLV Value's Length NOTE: Value is the length of the TLV Value only, does not include the length of the type and length fields A unsigned short representing the concatenated Type and Length The IANA (Internet Assigned Numbers Authority) Address Family Source http://www.iana.org/assignments/address-family-numbers/ IP version 4 IP version 6 NSAP HDLC BBN 1822 802 (includes all 802 media plus Ethernet "canonical format") E.163 Base class for several TLV types that all contain strings Creates a String TLV The Port Description TLV's offset from the origin of the LLDP Create from a type and string value A A A textual Description of the port Convert this Port Description TLV to a string. A human readable string Custom collection for TLV types Special behavior includes: - Preventing an EndOfLLDPDU tlv from being added out of place - Checking and throwing exceptions if one-per-LLDP packet TLVs are added multiple times Override to: - Prevent duplicate end tlvs from being added - Ensure that an end tlv is present - Replace any automatically added end tlvs with the user provided tlv A A Wake-On-Lan See: http://en.wikipedia.org/wiki/Wake-on-LAN See: http://wiki.wireshark.org/WakeOnLAN Create a Wake-On-LAN packet from the destination MAC address A Constructor A The Physical Address (MAC) of the host being woken up from sleep Returns the embedded Wake-On-LAN packet or null if there is none A Wake-On-LAN packet Generate a random WakeOnLanPacket A Checks the validity of the Wake-On-LAN payload - by checking the synchronization sequence - by checking to see if there are 16 iterations of the Destination MAC address True if the Wake-On-LAN payload is valid See IsValid A A Compare two instances A A GetHashCode override A The available types of strings that the ToString(StringOutputType) can handle. Outputs the packet info on a single line Outputs the packet info on a single line with coloring Outputs the detailed packet info Outputs the detailed packet info with coloring No Operation Option Used in the TCP Options field to pad the length to the next 32 byte boundary References: http://datatracker.ietf.org/doc/rfc793/ Creates a No Operation Option A A A The length (in bytes) of the NoOperation option The length of the NoOperation field Returns 1 as opposed to returning the length field because the NoOperation option is only 1 byte long and doesn't contain a length field End-of-Options Option Marks the end of the Options list References: http://datatracker.ietf.org/doc/rfc793/ Creates an End Of Options Option A A A The length (in bytes) of the EndOfOptions option The length of the EndOfOptions field Returns 1 as opposed to returning the length field because the EndOfOptions option is only 1 byte long and doesn't contain a length field Maximum Segment Size Option An extension to the DataOffset/HeaderLength field to allow sizes greater than 65,535 References: http://datatracker.ietf.org/doc/rfc793/ Creates a Maximum Segment Size Option A A A The Maximum Segment Size Returns the Option info as a string A A TCP Option Creates an Option from a byte[] A A A The length (in bytes) of the Kind field The length (in bytes) of the Length field The offset (in bytes) of the Kind Field The offset (in bytes) of the Length field The Length of the Option type The Kind of option Returns a TLV that contains the Option Returns the Option info as a string A Window Scale Factor Option Expands the definition of the TCP window to 32 bits References: http://datatracker.ietf.org/doc/rfc1323/ Creates a Window Scale Factor Option A A A The Window Scale Factor used as a multiplier to the window value The multiplier is equal to 1 left-shifted by the ScaleFactor So a scale factor of 7 would equal 1 << 7 = 128 Returns the Option info as a string The multiplier is equal to a value of 1 left-shifted by the scale factor A The different types fields that could be found in the Options field References: http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_Timestamps http://www.networksorcery.com/enp/default1101.htm End Of List See RFC 793 No Operation See RFC 793 Maximum Segment Size See RFC 793 Window Scale Factor See RFC 1323 SACK (Selective Ack) Permitted See RFC 2018 SACK (Selective Ack) See RFC 2018 and RFC 2883 Echo (obsolete) See RFC 1072 Echo Reply (obsolete) See RFC 1072 Timestamp See RFC 1323 Partial Order Connection Permitted (experimental) See RFC 1693 Partial Order Service Profile (experimental) See RFC 1693 Connection Count (experimental) See RFC 1644 Connection Count New (experimental) See RFC 1644 Connection Count Echo (experimental) See RFC 1644 Alternate Checksum Request See RFC 1146 Alternate Checksum Data See RFC 1146 MD5 Signature See RFC 2385 Quick-Start Response (experimental) See RFC 4782 User Timeout See RFC 5482 SACK (Selective Ack) Permitted Option Notifies the receiver that SACK is allowed. Must only be sent in a SYN segment References: http://datatracker.ietf.org/doc/rfc2018/ Creates a Sack Permitted Option A A A SACK (Selective Ack) Option Provides a means for a receiver to notify the sender about all the segments that have arrived successfully. Used to cut down on the number of unnecessary re-transmissions. References: http://datatracker.ietf.org/doc/rfc2018/ http://datatracker.ietf.org/doc/rfc2883/ Creates a SACK (Selective Ack) Option A A A Contains an array of SACK (Selective Ack) Blocks Returns the Option info as a string A Echo Reply Option Marked obsolete in the TCP spec Echo Reply Option has been replaced by the TSOPT (Timestamp Option) References: http://datatracker.ietf.org/doc/rfc1072/ Creates an Echo Reply Option A A A A Time Stamp Option Used for RTTM (Round Trip Time Measurement) and PAWS (Protect Against Wrapped Sequences) Opsoletes the Echo and EchoReply option fields References: http://datatracker.ietf.org/doc/rfc1323/ Creates a Timestamp Option A A A The Timestamp value The Echo Reply Returns the Option info as a string A An Echo Option throws an exception because Echo Options are obsolete as per their spec Creates an Echo Option A A A AlternateChecksumRequest Option Creates an Alternate Checksum Request Option Used to negotiate an alternative checksum algorithm in a connection A A A References: http://datatracker.ietf.org/doc/rfc1146/ The Checksum Returns the Option info as a string A Specifies the different types of algorithms that the Alternative Checksum option are allowed to use References: http://datatracker.ietf.org/doc/rfc1146/ Standard TCP Checksum Algorithm 8-bit Fletchers Algorighm 16-bit Fletchers Algorithm Redundant Checksum Avoidance Alternative Checksum Date Used as an extension to Alternative Checksum Response when the checksum is longer than the standard 16bit TCP Checksum field References: http://datatracker.ietf.org/doc/rfc1146/ Creates an Alternate Checksum Data Option A A A The array of attached Checksum Returns the Option info as a string A MD5 Signature Carries the MD5 Digest used by the BGP protocol to ensure security between two endpoints References: http://datatracker.ietf.org/doc/rfc2385/ Creates a MD5 Signature Option A A A The MD5 Digest Returns the Option info as a string A User Timeout Option The TCP user timeout controls how long transmitted data may remain unacknowledged before a connection is forcefully closed References: http://datatracker.ietf.org/doc/rfc5482/ Creates a User Timeout Option A A A The Granularity The User Timeout Returns the Option info as a string A A of InformationElements. The order and set of Information Elements allowed in a particular 802.11 frame type is dictated by the 802.11 standards. Initializes an empty . Initializes a new instance of the class. The elements to be included in the list. Initializes a new instance of the class. A containing one or more information elements. bas.Offset should point to the first byte of the first Information Element. Gets the total length in bytes of the list if its elements were serialised into a byte array The length Gets a Byte[] containing the serialised InformationElements The serialised InformationElements Finds all InformatonElements in the lists with the provided id. The InformationElements found, or an empty array if none are found The Id to search for Finds the first in the list with the provided id. The first element with the provided Id or null if the list contains no relevant elements The Id to search for Serialises the InformationElements in the list into the provided buffer. The to copy the elements into. The offset into destination at which to start copy the InformationElements Ensure that the destination is large enough to contain serialised elements before calling this method Implements a 32-bits cyclic redundancy check (CRC) hash algorithm. This class is not intended to be used for security purposes. For security applications use MD5, SHA1, SHA256, SHA384, or SHA512 in the System.Security.Cryptography namespace. Creates a CRC32 object using the . Creates a CRC32 object using the specified polynomial. The polynomial should be supplied in its bit-reflected form. . Gets the default polynomial (used in WinZip, Ethernet, etc.) The default polynomial is a bit-reflected version of the standard polynomial 0x04C11DB7 used by WinZip, Ethernet, etc. Computes the CRC32 value for the given ASCII string using the . Computes the CRC32 value for the given input stream using the . Computes the CRC32 value for the input data using the . Computes the hash value for the input data using the . Computes the hash value for the given ASCII string. The computation preserves the internal state between the calls, so it can be used for computation of a stream data. Computes the hash value for the given input stream. The computation preserves the internal state between the calls, so it can be used for computation of a stream data. Computes the hash value for the input data. The computation preserves the internal state between the calls, so it can be used for computation of a stream data. Computes the hash value for the input data. The computation preserves the internal state between the calls, so it can be used for computation of a stream data. Initializes an implementation of HashAlgorithm. Routes data written to the object into the hash algorithm for computing the hash. Finalizes the hash computation after the last data is processed by the cryptographic stream object. from PPI v 1.0.10 PpiReserved0 PpiReserved1 PpiCommon PpiMacExtensions PpiMacPhy PpiSpectrum PpiProcessInfo PpiCaptureInfo PpiAggregation Ppi802_3 PpiReservedAll Contains information specific to 802.3 packets. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Standard Flags. Error Flags. Initializes a new instance of the class. 802.3 specific extension flags. FCS is present at the end of the packet Flags for errors detected at the time the packet was captured. The frames FCS is invalid. The frame has a sequence error. The frame has a symbol error. The frame has a data error. Type of the field Gets the length of the field data. The length. Gets or sets the standard 802.2 flags. The standard flags. Gets or sets the 802.3 error flags. The error flags. Gets the field bytes. This doesn't include the PPI field header. The bytes. The PPI Aggregation field is used to identify which physical interface a frame was collected on when multiple capture interfaces are in use. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. The interface id. Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Zero-based index of the physical interface the packet was captured from. The interface id. Gets the field bytes. This doesn't include the PPI field header. The bytes. The PPI Capture Info field has been assigned a PPI field type but currently has no defined field body. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Gets the field bytes. This doesn't include the PPI field header. The bytes. The PPI Common field contains fields common to all 802.11 specifications. This field is loosely based on the Radio Tap header format. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. AntennaSignalPower and AntennaSignalNoise are both set to their minimum value of -128. Common 802.11 flags. Defines whether or not an FCS is included at the end of the encapsulated 802.11 frame. If set the TSF-timer is in milliseconds, if not set the TSF-timer is in microseconds Indicates that the FCS on the encapsulated 802.11 frame is invalid Indicates that there was some type of physical error when receiving the packet. Type of the field Gets the length of the field data. The length. Radiotap-formatted channel flags. Radiotap-formatted channel frequency, in MHz. 0 indicates an invalid value. The channel frequency. The common flags. Data rate in multiples of 500 Kbps. 0 indicates an invalid value. The data rate. Gets or sets the TSF timer. The TSF Timer value. Gets or sets the Frequency-hopping spread spectrum (FHSS) hopset The FHSS hopset. Gets or sets the Frequency-hopping spread spectrum (FHSS) pattern. The FHSS pattern. Gets or sets the RF signal power at antenna. The antenna signal power. Gets or sets the RF signal noise at antenna The antenna signal noise. Gets the field bytes. This doesn't include the PPI field header. The bytes. Abstract class for all PPI fields Type of the field Gets the length of the field data. The length. Gets the field bytes. This doesn't include the PPI field header. The bytes. Parse a PPI indicated by type, from a given BinaryReader A A The maximum number of bytes that the field to be parsed can encompass. A 802.11n MAC Extension flags. Indicates the use of Greenfield (or HT) mode. In greenfield mode support for 802.11 a/b/g devices is sacrificed for increased efficiency. Indicates the High Throughput (HT) mode. If not set channel width is 20MHz, if set it is 40MHz. Indicates the use of a Short Guard Interval (SGI). Indicates the use of HT Duplicate mode. Indicates the use of MPDU aggregation. Indicates the presence of more aggregate frames. Indicates there was a CRC error in the A-MPDU delimiter after this frame. The 802.11n MAC Extension field contains radio information specific to 802.11n. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Gets or sets the 802.11n MAC extension flags. The flags. Gets or sets the A-MPDU identifier. the A-MPDU id. Gets or sets the number of zero-length pad delimiters The delimiter count. Gets the field bytes. This doesn't include the PPI field header. The bytes. The 802.11n MAC + PHY Extension field contains radio information specific to 802.11n. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Gets or sets the 802.11n MAC extension flags. The flags. Gets or sets the A-MPDU identifier. the A-MPDU id. Gets or sets the number of zero-length pad delimiters The delimiter count. Gets or sets the modulation coding scheme. The modulation coding scheme. Gets or sets the number of spatial streams. The spatial stream count. Gets or sets the combined Received Signal Strength Indication (RSSI) value from all the active antennas and channels. The combined RSSI. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 0, control channel. The antenna 0 RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 1, control channel. The antenna 1 control channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 2, control channel. The antenna 2 control channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 3, control channel. The antenna 3 control channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 0, extension channel The antenna 0 extension channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 1, extension channel The antenna 1 extension channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 2, extension channel The antenna 2 extension channel RSSI value. Gets or sets the Received Signal Strength Indication (RSSI) value for the antenna 3, extension channel The antenna 3 extension channel RSSI value. Gets or sets the extension channel frequency. The extension channel frequency. Gets or sets the extension channel flags. The extension channel flags. Gets or sets the RF signal power at antenna 0. The signal power. Gets or sets the RF signal noise at antenna 0. The signal noise. Gets or sets the RF signal power at antenna 1. The signal power. Gets or sets the RF signal noise at antenna 1. The signal noise. Gets or sets the RF signal power at antenna 2. The signal power. Gets or sets the RF signal noise at antenna 2. The signal noise. Gets or sets the RF signal power at antenna 3. The signal power. Gets or sets the RF signal noise at antenna 3. The signal noise. Gets or sets the error vector magnitude for Chain 0. The error vector magnitude. Gets or sets the error vector magnitude for Chain 1. The error vector magnitude. Gets or sets the error vector magnitude for Chain 2. The error vector magnitude. Gets or sets the error vector magnitude for Chain 3. The error vector magnitude. Gets the field bytes. This doesn't include the PPI field header. The bytes. PPI process info field. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Gets or sets the process identifier. The process identifier. Gets or sets the thread identifier. The thread identifier. Gets or sets the process path. The process path. Gets or sets the user identifier. The user identifier. Gets or sets the user name. The user name. Gets or sets the group identifier. The group identifier. Gets or sets the group name. The group name. Gets the field bytes. This doesn't include the PPI field header. The bytes. The PpiUnknown field class can be used to represent any field types not currently supported by PacketDotNet. Any unsupported field types encountered during parsing will be stored as PpiUnknown fields. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The PPI field type number The stream the field will be read from The number of bytes the unknown field contains. Initializes a new instance of the class. The PPI field type number. Initializes a new instance of the class. The PPI field type number. The field data. Type of the field Gets the length of the field data. The length. Gets the field bytes. This doesn't include the PPI field header. The bytes. Gets or sets the field data. The fields values bytes. The PPI Spectrum field is intended to be compatible with the sweep records returned by the Wi-Spy spectrum analyzer. Initializes a new instance of the class from the provided stream. The position of the BinaryReader's underlying stream will be advanced to the end of the PPI field. The stream the field will be read from Initializes a new instance of the class. Type of the field Gets the length of the field data. The length. Gets or sets the starting frequency in kHz. The starting frequency. Gets or sets the resolution of each sample in Hz. The resolution in Hz. Gets or sets the amplitude offset (in 0.001 dBm) The amplitude offset. Gets or sets the amplitude resolution (in .001 dBm) The amplitude resolution. Gets or sets the maximum raw RSSI value reported by the device. The maximum rssi. Gets or sets the data samples. The data samples. Gets the field bytes. This doesn't include the PPI field header. The bytes. As defined by Airpcap.h NOTE: PresentPosition may not be the only position present as this the field can be extended if the high bit is set Position of the first iField Header Length of the Data Link Type The data link type position. Length of the Flags field Position of the Flags field Length of the length field Position of the length field Length of the version field Position of the version field The total length of the ppi packet header The length of the PPI field header .Net analog of a PpiHeader.h from airpcap Initializes a new instance of the class. A Initializes a new instance of the class. PPI packet header flags. Indicates whether or not the PPI fields are aligned to a 32 bit boundary. Gets the at the specified index. Index. Length of the whole header in bytes Version 0. Only increases for drastic changes, introduction of compatible new fields does not count. Gets or sets the PPI header flags. The PPI header flags. Gets or sets the type of the link type specified in the PPI packet. This should be the link type of the encapsulated packet. The link type. Returns the number of PPI fields in the PPI packet. The number of fields. Add the specified field to the packet. the field. Removes the specified field from the packet. the field. Removes all fields of the specified type. the field type to be removed. Checks whether the specified field is in the packet. true if the field is in the packet, false if not. Checks whether there is field of the specified type in the packet. true if there is a field of the specified type in the packet, false if not. Finds the first field in the packet of the specified type. The first field in the packet of the specified type, or null if there is no field of the specified type. The type of packet to find. Finds the fields in the packet of the specified type. The fields of the specified type, or an empty array of there are no fields of that type. The type of packet to find. Returns the Ieee80211MacFrame inside of the Packet p or null if there is no encapsulated packet A A Gets the enumerator of PPI fields. The field enumerator. Called to ensure that field values are updated before the packet bytes are retrieved Array of PPI fields Used by the Ieee80211PpiPacket constructor. A The object in the PPI packet or null if not available A Format of an ACK frame Constructor A Initializes a new instance of the class. Receiver address. Receiver address Length of the frame Writes the current packet properties to the backing ByteArraySegment. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string. Format of a CTS frame Constructor A Initializes a new instance of the class. Receiver address. Receiver address Length of the frame Writes the current packet properties to the backing ByteArraySegment. Returns a string with a description of the addresses used in the packet. This is used as a compoent of the string returned by ToString(). The address string.