Extract HTTP header information using Packet.Net

Question

I would like to extract the HTTP header information using Packet.Net. I am using SharpPcap to capture the packet and need to access the User-Agent field in the TCP packet. If I understand correctly Packet.Net is used to analyze the packet captured. Help would be appreciated on this regard. I have tried to display the TCP packet with the following code but I get bytes displayed. I am using C# as development language.

       private static void device_OnPacketArrival(object sender,CaptureEventArgs packet){

       Packet p =Packet.ParsePacket(packet.Device.LinkType,packet.Packet.Data);

       System.Text.ASCIIEncoding ASCII = new System.Text.ASCIIEncoding();
       String StringMessage = ASCII.GetString(p.Bytes);


       Console.WriteLine(StringMessage);

   }

What do you mean by 'I get bytes displayed'? Can you provide sample output of what you're seeing? — M.Babcock, Jan 06 '12 at 13:43
You may also consider using [Pcap.Net](http://pcapdotnet.codeplex.com/) rather than SharpPcap in your situation because it has built in support for parsing HTTP messages. — M.Babcock, Jan 06 '12 at 13:50

score 1 · Answer 1 · answered Feb 01 '12 at 16:20

Packet.Net doesn't currently have http decoding support. Because http messages can be split across multiple packets, it seems like a good approach would be to first add support to allow the following of tcp connections, then add http session detection and parsing on top of the tcp data stream. Trying to parse http data on a per-packet basis might work for the headers of the data or some http messages but isn't a robust solution as it would prevent being able to get the full content of the http message that might be several kilobytes in size.

(I have a commercial library that builds upon SharpPcap/Packet.Net that adds tcp session following and http session following and decode. Post your email here if you want me to email you with more details.)

Extract HTTP header information using Packet.Net

1 Answers1