Extract HTTP header information using Packet.Net

Question

I would like to extract the HTTP header information using Packet.Net. I am using SharpPcap to capture the packet and need to access the User-Agent field in the TCP packet. If I understand correctly Packet.Net is used to analyze the packet captured. Help would be appreciated on this regard. I have tried to display the TCP packet with the following code but I get bytes displayed. I am using C# as development language.

       private static void device_OnPacketArrival(object sender,CaptureEventArgs packet){

       Packet p =Packet.ParsePacket(packet.Device.LinkType,packet.Packet.Data);

       System.Text.ASCIIEncoding ASCII = new System.Text.ASCIIEncoding();
       String StringMessage = ASCII.GetString(p.Bytes);


       Console.WriteLine(StringMessage);

   }

What do you mean by 'I get bytes displayed'? Can you provide sample output of what you're seeing? — M.Babcock
– M.Babcock, Commented Jan 6, 2012 at 13:43
You may also consider using Pcap.Net rather than SharpPcap in your situation because it has built in support for parsing HTTP messages. — M.Babcock
– M.Babcock, Commented Jan 6, 2012 at 13:50

Chris Morgan · Accepted Answer · 2012-02-01 16:20:50Z

1

Packet.Net doesn't currently have http decoding support. Because http messages can be split across multiple packets, it seems like a good approach would be to first add support to allow the following of tcp connections, then add http session detection and parsing on top of the tcp data stream. Trying to parse http data on a per-packet basis might work for the headers of the data or some http messages but isn't a robust solution as it would prevent being able to get the full content of the http message that might be several kilobytes in size.

(I have a commercial library that builds upon SharpPcap/Packet.Net that adds tcp session following and http session following and decode. Post your email here if you want me to email you with more details.)

answered Feb 1, 2012 at 16:20

Chris Morgan

1,3891 gold badge17 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Extract HTTP header information using Packet.Net

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related