How to distinguish between Incoming and Outgoing packets

Jan 29, 2015 at 8:42 AM
Edited Jan 29, 2015 at 8:44 AM
Hi,

first of all: Great library! I'm using it in my bachelor thesis :)

Is there an easy way to distinguish between incoming and outgoing packets?

I have to filter the traffic depending on my local ports. For Example firefox is using Port 50 and 51. I want all outgoing packets from port 50 and 51 and all incoming packets going to these ports.

My current code is:
var devices = LivePacketDevice.AllLocalMachine;
foreach(var livePacketDevice in devices) {
    var communicator = livePacketDevice.Open(PacketDevice.DefaultSnapshotLength,
        PacketDeviceOpenAttributes.MaximumResponsiveness, 0);
    if(communicator.DataLink.Kind != DataLinkKind.Ethernet) {
        communicator.Dispose();
        continue;
    }

    mPacketCommunicatorsInUse.Add(
        new RunningCaptureEntry {
            Communicator = communicator,
            Task = Task.Factory.StartNew(() => {
                int i = 0;
                var com = communicator;
                com.CreateFilter("ip and (tcp or udp)");
                com.ReceivePackets(-1, packet => {
                    Debug.WriteLine("Packet received!" + i++);
                });
            }, TaskCreationOptions.LongRunning)
        });
}
Any advice?

Thanks in advance
Coordinator
Jan 30, 2015 at 8:29 AM
You can use the Ethernet addresses to check if it is an incoming packet or an outgoing one.
Note that there's a LivePacketDevice extension method, GetMacAddress, which returns the MAC address of the device.
Jan 30, 2015 at 8:56 AM
Thank you :)

Maybe it's an Extensionmethod IsIncomingPacket() or IsOutgoingPacket() or a new property possible? (as a feature suggestion)
Coordinator
Jan 30, 2015 at 9:33 AM
Since the packets you read in Pcap.Net are not necessarily incoming or outgoing (or even Ethernet), such functionality doesn't seem to be fitting for Pcap.Net as a generic library.