verinec.importer.analysis.sniffer
Class SnifferThread

java.lang.Object
  java.lang.Thread
      verinec.importer.analysis.AAnalyserTask
          verinec.importer.analysis.sniffer.SnifferThread

All Implemented Interfaces:

Runnable

public class SnifferThread
extends AAnalyserTask

Captures packets on the specified network device.

An instance of this Class will be created for each device. It captures the traffic on an interface and adds detected information to the list of known hosts.
As there is only one global list of hosts, thus if we detect the a host with the same IP on more than one interface, it will be considered the same host. In redundant networks, this avoids duplicating hosts. (If there are two different hosts with the same IP visible from our machine, the network is in a very bad analysisState indeed.)

Author:

Patrick Aebischer, david.buchmann at unifr.ch, martial.seifriz at unifr.ch

Nested Class Summary

Nested classes/interfaces inherited from class java.lang.Thread

Thread.State, Thread.UncaughtExceptionHandler

Field Summary

private double	count Time in seconds or number of packets.
private jpcap.NetworkInterface	device Device name to sniff.
private double	final_count The number of packages or the time for the sniffing
private int	id The identifier of this thread
private Logger	logger The logger for this object
private int	mode One of the modes defined in Configure.
private StartSniffer	startSniffer Reference to the main application.
private double	t_start The time when the execution of the sniffer starts

Fields inherited from class java.lang.Thread

MAX_PRIORITY, MIN_PRIORITY, NORM_PRIORITY

Constructor Summary

SnifferThread(jpcap.NetworkInterface device, int mode, long count, StartSniffer startSniffer, int id)
Create a new Sniffer.

Method Summary

void	abortOperation() Stop packet capturing on this interface.
private void	ARPTreatment(jpcap.packet.Packet packet) Analyses an ARP Packet.
private void	ICMPTreatment(jpcap.packet.Packet packet) Analyses an ICMP Packet.
private void	OtherIPTreatement(jpcap.packet.IPPacket packet) Unrecognized IPPacket..
void	packetArrived(jpcap.packet.Packet packet) Depending on packet type, invokes the appropriate analysis.
void	run() Configuring jpcap as defined in the ConfigPanel and sniff on the specified interface.
private void	sniff() Stop packet capturing on this interface.
private void	TCPTreatment(jpcap.packet.TCPPacket packet) Analyses a TCP packet.
private void	TCPUDPTreatement(jpcap.packet.IPPacket packet, int srcPort, int dstPort) Common treatement for tcp and udp packets.
private boolean	testContinueSniffing()
private void	UDPTreatement(jpcap.packet.UDPPacket packet) Analyses a UDP packet.
private void	updateCount()

Methods inherited from class verinec.importer.analysis.AAnalyserTask

getStarter, printMessage, setStarter

Methods inherited from class java.lang.Thread

activeCount, checkAccess, countStackFrames, currentThread, destroy, dumpStack, enumerate, getAllStackTraces, getContextClassLoader, getDefaultUncaughtExceptionHandler, getId, getName, getPriority, getStackTrace, getState, getThreadGroup, getUncaughtExceptionHandler, holdsLock, interrupt, interrupted, isAlive, isDaemon, isInterrupted, join, join, join, resume, setContextClassLoader, setDaemon, setDefaultUncaughtExceptionHandler, setName, setPriority, setUncaughtExceptionHandler, sleep, sleep, start, stop, stop, suspend, toString, yield

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

mode

private int mode

One of the modes defined in Configure.

device

private jpcap.NetworkInterface device

Device name to sniff.

count

private double count

Time in seconds or number of packets.

final_count

private double final_count

The number of packages or the time for the sniffing

t_start

private double t_start

The time when the execution of the sniffer starts

startSniffer

private StartSniffer startSniffer

Reference to the main application.

logger

private Logger logger

The logger for this object

id

private int id

The identifier of this thread

Constructor Detail

SnifferThread

public SnifferThread(jpcap.NetworkInterface device,
                     int mode,
                     long count,
                     StartSniffer startSniffer,
                     int id)

Create a new Sniffer.

Parameters:

device - The interface to sniff on.

mode - A mode defined in StartSniffer.ConfigPanel: TIME,PACKETS,SIMULATE.

count - Time in seconds or number of packets.

startSniffer - The sniffer common object.

id - to report back to the sniffer common object.

Method Detail

run

public void run()

Configuring jpcap as defined in the ConfigPanel and sniff on the specified interface.

Specified by:

run in interface Runnable

Overrides:

run in class Thread

sniff

private void sniff()
            throws IOException

Stop packet capturing on this interface. As hosts are reported to the list as they are found, the results achieved sofar are not lost.

Throws:

IOException - if capturing is interrupted.

updateCount

private void updateCount()

testContinueSniffing

private boolean testContinueSniffing()

packetArrived

public void packetArrived(jpcap.packet.Packet packet)

Depending on packet type, invokes the appropriate analysis. This method is invoked by jpcap, when a packet arrives.

Parameters:

packet - The received packet.

OtherIPTreatement

private void OtherIPTreatement(jpcap.packet.IPPacket packet)

Unrecognized IPPacket..

Parameters:

packet - An arbitrary IP packet.

TCPTreatment

private void TCPTreatment(jpcap.packet.TCPPacket packet)

Analyses a TCP packet.

Parameters:

packet - TCP packet to analyse.

UDPTreatement

private void UDPTreatement(jpcap.packet.UDPPacket packet)

Analyses a UDP packet.

Parameters:

packet - UDP packet to analyse.

TCPUDPTreatement

private void TCPUDPTreatement(jpcap.packet.IPPacket packet,
                              int srcPort,
                              int dstPort)

Common treatement for tcp and udp packets.

Parameters:

packet - The IP packet to analyse.

srcPort - Source port the packet originates from.

dstPort - Destination port the packet was addressed to.

ARPTreatment

private void ARPTreatment(jpcap.packet.Packet packet)

Analyses an ARP Packet.

Parameters:

packet - Packet to analyse.

ICMPTreatment

private void ICMPTreatment(jpcap.packet.Packet packet)

Analyses an ICMP Packet.

Parameters:

packet - Packet to analyse.

abortOperation

public void abortOperation()

Stop packet capturing on this interface. As hosts are reported to the list as they are found, the results achieved sofar are not lost.

Specified by:

abortOperation in class AAnalyserTask