Examples with TCPPacket com.att.aro.core.packetreader.pojo.TCPPacket used on opensource projects

Example 1 with TCPPacket

use of com.att.aro.core.packetreader.pojo.TCPPacket in project VideoOptimzer by attdevsupport.

the class HttpsUsageImpl method buildHttpsUsageEntry.

/*
	 * If an IP contains a session that does not contain any SSL packet, we
	 * create a HttpsUsageEntry for it.
	 *
	 * This method loops through the IP-sessions map, and returns the list of
	 * HttpsUsageEntry created. If no IP from the IP-sessions map contains a
	 * connection that we consider as HTTP, the method returns an empty list.
	 */
private List<HttpsUsageEntry> buildHttpsUsageEntry(Map<InetAddress, List<Session>> ipSessionsMap) {
    List<HttpsUsageEntry> results = new ArrayList<HttpsUsageEntry>();
    for (Map.Entry<InetAddress, List<Session>> ipSessions : ipSessionsMap.entrySet()) {
        int totalNumConnectionsCurrentIp = 0;
        int totalNumHttpConnectionsCurrentIp = 0;
        int totalHttpTrafficInByteCurrentIp = 0;
        int totalTrafficInByteCurrentIp = 0;
        int httpTrafficPercentage = 0;
        for (Session session : ipSessions.getValue()) {
            boolean isSslSession = false;
            // Excluding UDP Sessions
            if (session.isUdpOnly()) {
                continue;
            }
            List<PacketInfo> packetsInfo = session.getTcpPackets();
            if (packetsInfo.isEmpty()) {
                LOGGER.error("Session without packets! Session's remote IP and port: " + session.getRemoteIP().getHostAddress() + ":" + session.getRemotePort());
                continue;
            }
            /*
				 * Determine if the TCP session is using SSL/TLS. If we find at
				 * least one TCP packet that contains one or more SSL record(s),
				 * we consider that session a SSL session.
				 */
            for (PacketInfo packetInfo : packetsInfo) {
                Packet packet = packetInfo.getPacket();
                if ((packet instanceof TCPPacket) && ((TCPPacket) packet).containsSSLRecord()) {
                    isSslSession = true;
                    break;
                }
            }
            /*
				 * Calculate traffic size for the TCP session
				 */
            // total packet size (ip header + tcp header + payload) of all
            // the packets in the session
            // total payload size of all the packets in the session
            int totalPacketsPayloadSize = 0;
            for (PacketInfo packetInfo : packetsInfo) {
                totalPacketsPayloadSize += packetInfo.getPayloadLen();
            }
            totalNumConnectionsCurrentIp++;
            totalTrafficInByteCurrentIp += totalPacketsPayloadSize;
            if (!(totalPacketsPayloadSize == 0 || isSslSession)) {
                totalHttpTrafficInByteCurrentIp += totalPacketsPayloadSize;
                totalNumHttpConnectionsCurrentIp++;
            }
        }
        // End all sessions associated to an IP
        if (totalNumHttpConnectionsCurrentIp > 0) {
            BigDecimal totalTrafficInKBCurrentIp = new BigDecimal(totalTrafficInByteCurrentIp).divide(new BigDecimal(1000), 3, RoundingMode.HALF_UP);
            BigDecimal totalHttpTrafficInKBCurrentIp = new BigDecimal(totalHttpTrafficInByteCurrentIp).divide(new BigDecimal(1000), 3, RoundingMode.HALF_UP);
            int httpConnectionsPercentage = getHttpConnectionsPercentage(totalNumHttpConnectionsCurrentIp, totalNumConnectionsCurrentIp);
            /*
				 * Initialize percentage to be 0 to avoid getting the
				 * divide-by-zero exception for any unexpected reason.
				 */
            if (totalTrafficInByteCurrentIp <= 0) {
                LOGGER.error("Total traffic size of all TCP sessions is zero or less (" + totalTrafficInByteCurrentIp + " byte)! IP: " + ipSessions.getKey().getHostAddress());
            } else {
                httpTrafficPercentage = getHttpTrafficPercentage(totalHttpTrafficInByteCurrentIp, totalTrafficInByteCurrentIp);
            }
            String parentDomainName = getParentDomainName(ipSessions.getKey(), ipSessions.getValue());
            results.add(new HttpsUsageEntry(ipSessions.getKey().getHostAddress(), parentDomainName, totalNumConnectionsCurrentIp, totalNumHttpConnectionsCurrentIp, httpConnectionsPercentage, totalTrafficInKBCurrentIp, totalHttpTrafficInKBCurrentIp, httpTrafficPercentage));
        }
        totalNumHttpConnectionsCurrentTrace += totalNumHttpConnectionsCurrentIp;
        totalNumConnectionsCurrentTrace += totalNumConnectionsCurrentIp;
    }
    // End all IPs
    return results;
}

Example 2 with TCPPacket

use of com.att.aro.core.packetreader.pojo.TCPPacket in project VideoOptimzer by attdevsupport.

the class SessionManagerImpl method analyzeACK.

/**
 * Analyze the packet to find the TCPInfo. Marked flags: TCP_ACK,
 * TCP_ACK_DUP, TCP_WINDOW_UPDATE, TCP_KEEP_ALIVE_ACK
 */
private void analyzeACK(Session sess) {
    Map<Long, Integer> ulAckWinSize = new HashMap<Long, Integer>();
    Map<Long, Integer> dlAckWinSize = new HashMap<Long, Integer>();
    Set<Long> ulAliveAck = new HashSet<Long>();
    Set<Long> dlAliveAck = new HashSet<Long>();
    for (PacketInfo pinfo : sess.getTcpPackets()) {
        TCPPacket pack = (TCPPacket) pinfo.getPacket();
        if (!pack.isACK()) {
            continue;
        }
        long ackNum = pack.getAckNumber();
        int win = pack.getWindow();
        Map<Long, Integer> pAckWinSize;
        Set<Long> pAliveAck;
        Set<Long> pAliveAck2;
        switch(pinfo.getDir()) {
            case UPLINK:
                pAckWinSize = ulAckWinSize;
                pAliveAck = ulAliveAck;
                pAliveAck2 = dlAliveAck;
                break;
            case DOWNLINK:
                pAckWinSize = dlAckWinSize;
                pAliveAck = dlAliveAck;
                pAliveAck2 = ulAliveAck;
                break;
            default:
                LOGGER.warn("97 - No direction for packet. Packet ID: " + pinfo.getPacketId());
                continue;
        }
        if (pinfo.getTcpInfo() == TcpInfo.TCP_KEEP_ALIVE) {
            pAliveAck.add(pack.getSequenceNumber());
            continue;
        }
        int tcpFlag;
        if (pack.isFIN()) {
            tcpFlag = 1;
        } else if (pack.isSYN()) {
            tcpFlag = 2;
        } else if (pack.isRST()) {
            tcpFlag = 4;
        } else {
            tcpFlag = 0;
        }
        long key = ((ackNum << 32) | tcpFlag);
        int payloadLen = pack.getPayloadLen();
        if (pAliveAck2.contains(ackNum - 1) && payloadLen == 0 && !pack.isSYN() && !pack.isFIN() && !pack.isRST()) {
            pinfo.setTcpInfo(TcpInfo.TCP_KEEP_ALIVE);
        } else if (!pAckWinSize.containsKey(key)) {
            pAckWinSize.put(key, win);
            if (payloadLen == 0 && !pack.isSYN() && !pack.isFIN() && !pack.isRST()) {
                pinfo.setTcpInfo(TcpInfo.TCP_ACK);
            }
        } else {
            int prevWin = pAckWinSize.get(key);
            if (win == prevWin) {
                if (payloadLen == 0 && !pack.isRST() && pinfo.getTcpInfo() != TcpInfo.TCP_KEEP_ALIVE) {
                    pinfo.setTcpInfo(TcpInfo.TCP_ACK_DUP);
                }
            } else {
                pAckWinSize.put(key, win);
                if (payloadLen == 0 && !pack.isRST() && pinfo.getTcpInfo() != TcpInfo.TCP_KEEP_ALIVE) {
                    pinfo.setTcpInfo(TcpInfo.TCP_WINDOW_UPDATE);
                }
            }
        }
    }
}

Example 3 with TCPPacket

use of com.att.aro.core.packetreader.pojo.TCPPacket in project VideoOptimzer by attdevsupport.

the class SessionManagerImpl method processPacketsAndAssembleSessions.

/**
 * Entry point into SessionManager from PacketAnalyzerImpl
 *
 * returns List<Session> sessionList
 */
public List<Session> processPacketsAndAssembleSessions(List<PacketInfo> packets) {
    LOGGER.warn("processPacketsAndAssembleSessions -> Trace path: " + tracePath);
    List<Session> sessions = new ArrayList<>();
    List<PacketInfo> udpPackets = new ArrayList<>();
    Map<InetAddress, String> hostMap = new HashMap<>();
    Map<String, Session> udpSessions = new LinkedHashMap<>();
    Map<String, PacketInfo> dnsRequestDomains = new HashMap<>();
    Map<String, List<Session>> tcpSessions = new LinkedHashMap<>();
    Map<InetAddress, PacketInfo> dnsResponsePackets = new HashMap<>();
    if (packets != null) {
        for (PacketInfo packetInfo : packets) {
            Packet packet = packetInfo.getPacket();
            if (packet instanceof UDPPacket) {
                // UDP
                udpPackets.add(packetInfo);
                if (((UDPPacket) packet).isDNSPacket()) {
                    DomainNameSystem dns = ((UDPPacket) packet).getDns();
                    if (dns != null && dns.isResponse()) {
                        for (InetAddress inet : dns.getIpAddresses()) {
                            hostMap.put(inet, dns.getDomainName());
                            dnsResponsePackets.put(inet, packetInfo);
                        }
                    } else if (dns != null && !dns.isResponse()) {
                        dnsRequestDomains.put(dns.getDomainName(), packetInfo);
                    }
                }
                associatePacketToUDPSessionAndPopulateCollections(sessions, udpSessions, packetInfo, (UDPPacket) packet);
            } else if (packet instanceof TCPPacket) {
                // TCP
                TCPPacket tcpPacket = (TCPPacket) packet;
                packetInfo.setTcpInfo(null);
                Session session = associatePacketToTCPSessionAndPopulateCollections(sessions, tcpSessions, packetInfo, tcpPacket);
                populateTCPPacketInfo(packetInfo, tcpPacket);
                session.setSsl(session.isSsl() ? session.isSsl() : tcpPacket.isSsl());
                if (tcpPacket.isDecrypted()) {
                    tcpPacket.setDataOffset(0);
                    session.setDecrypted(true);
                }
                if (session.getDnsResponsePacket() == null && dnsResponsePackets.containsKey(session.getRemoteIP())) {
                    session.setDnsResponsePacket(dnsResponsePackets.get(session.getRemoteIP()));
                    session.setDomainName((((UDPPacket) (session.getDnsResponsePacket()).getPacket()).getDns()).getIpAddresses().stream().findFirst().get().getHostName());
                }
                if (session.getDnsRequestPacket() == null && StringUtils.isNotBlank(session.getDomainName()) && dnsRequestDomains.containsKey(session.getDomainName())) {
                    session.setRemoteHostName(session.getDomainName());
                    session.setDnsRequestPacket(dnsRequestDomains.get(session.getDomainName()));
                } else {
                    session.setRemoteHostName(hostMap.get(session.getRemoteIP()));
                }
                if (tcpPacket.isSslHandshake()) {
                    session.setLastSslHandshakePacket(packetInfo);
                    if (tcpPacket.isClientHello() && StringUtils.isNotBlank(tcpPacket.getServerNameIndication())) {
                        session.setServerNameIndication(tcpPacket.getServerNameIndication());
                    }
                }
                if (packetInfo.getAppName() != null) {
                    session.getAppNames().add(packetInfo.getAppName());
                }
                if (!session.isSessionComplete() && (packetInfo.getTcpFlagString().contains("R") || packetInfo.getTcpFlagString().contains("F"))) {
                    session.setSessionComplete(true);
                }
                session.setLatency((!session.getSynAckPackets().isEmpty() && !session.getSynPackets().isEmpty()) ? calculateLatency(session) : -1);
            }
        }
    }
    Collections.sort(sessions);
    analyzeRequestResponses(sessions);
    return sessions;
}

Example 4 with TCPPacket

use of com.att.aro.core.packetreader.pojo.TCPPacket in project VideoOptimzer by attdevsupport.

the class SessionManagerImpl method extractHttpRequestResponseInfo.

private HttpRequestResponseInfo extractHttpRequestResponseInfo(ArrayList<HttpRequestResponseInfo> results, Session session, PacketInfo packetInfo, PacketDirection packetDirection, PacketInfo previousPacketInfo, int addToOffset) {
    TCPPacket tcpPacket = null;
    UDPPacket udpPacket = null;
    HttpRequestResponseInfo rrInfo = null;
    ByteArrayOutputStream stream = new ByteArrayOutputStream();
    BufferedOutputStream bufferedStream = new BufferedOutputStream(stream);
    int carryoverPayloadLength = 0;
    if (packetInfo.getPacket() instanceof TCPPacket) {
        tcpPacket = (TCPPacket) packetInfo.getPacket();
        try {
            if (previousPacketInfo != null) {
                TCPPacket previousTCPPacket = (TCPPacket) previousPacketInfo.getPacket();
                carryoverPayloadLength = previousTCPPacket.getData().length - (previousTCPPacket.getDataOffset() + addToOffset);
                bufferedStream.write(previousTCPPacket.getData(), (previousTCPPacket.getDataOffset() + addToOffset), carryoverPayloadLength);
            }
            bufferedStream.write(tcpPacket.getData(), tcpPacket.getDataOffset(), tcpPacket.getData().length - tcpPacket.getDataOffset());
        } catch (Exception exception) {
            LOGGER.error("Error Reading Data from TCP Packet: ", exception);
        }
    } else {
        udpPacket = (UDPPacket) packetInfo.getPacket();
        try {
            if (previousPacketInfo != null) {
                UDPPacket previousUDPPacket = (UDPPacket) previousPacketInfo.getPacket();
                carryoverPayloadLength = previousUDPPacket.getData().length - (previousUDPPacket.getDataOffset() + addToOffset);
                bufferedStream.write(previousUDPPacket.getData(), (previousUDPPacket.getDataOffset() + addToOffset), carryoverPayloadLength);
            }
            bufferedStream.write(udpPacket.getData(), udpPacket.getDataOffset(), udpPacket.getData().length - udpPacket.getDataOffset());
        } catch (Exception exception) {
            LOGGER.error("Error Reading Data from UDP Packet: ", exception);
        }
    }
    try {
        bufferedStream.flush();
        byte[] streamArray = stream.toByteArray();
        storageReader.init(streamArray);
        return getLastRRInfo(streamArray, packetInfo, tcpPacket, previousPacketInfo, carryoverPayloadLength, session, results, packetDirection);
    } catch (IOException e) {
        LOGGER.error(e);
    }
    return rrInfo;
}

Example 5 with TCPPacket

use of com.att.aro.core.packetreader.pojo.TCPPacket in project VideoOptimzer by attdevsupport.

the class PacketAnalyzerImplTest method test_getStatisticResult.

@Test
public void test_getStatisticResult() throws UnknownHostException {
    InetAddress iAdr = Mockito.mock(InetAddress.class);
    InetAddress iAdr1 = Mockito.mock(InetAddress.class);
    Mockito.when(iAdr.getAddress()).thenReturn(new byte[] { 89, 10, 1, 1 });
    Mockito.when(iAdr1.getAddress()).thenReturn(new byte[] { 72, 12, 13, 1 });
    Set<InetAddress> inetSet = new HashSet<InetAddress>();
    inetSet.add(iAdr);
    inetSet.add(iAdr1);
    DomainNameSystem dns = Mockito.mock(DomainNameSystem.class);
    Mockito.when(dns.getIpAddresses()).thenReturn(inetSet);
    Mockito.when(dns.getDomainName()).thenReturn("www.att.com");
    UDPPacket udpPacket = Mockito.mock(UDPPacket.class);
    Mockito.when(udpPacket.isDNSPacket()).thenReturn(true);
    Mockito.when(udpPacket.getDns()).thenReturn(dns);
    Mockito.when(udpPacket.getSourcePort()).thenReturn(83);
    Mockito.when(udpPacket.getDestinationPort()).thenReturn(84);
    Mockito.when(udpPacket.getDestinationIPAddress()).thenReturn(iAdr);
    PacketInfo packetInfo1 = Mockito.mock(PacketInfo.class);
    Mockito.when(packetInfo1.getPacket()).thenReturn(udpPacket);
    Mockito.when(packetInfo1.getDir()).thenReturn(PacketDirection.UPLINK);
    Mockito.when(packetInfo1.getPayloadLen()).thenReturn(0);
    Mockito.when(packetInfo1.getLen()).thenReturn(10);
    Mockito.when(packetInfo1.getAppName()).thenReturn("Test1");
    Mockito.when(packetInfo1.getTcpFlagString()).thenReturn("TestString");
    Mockito.when(packetInfo1.getTimeStamp()).thenReturn(500d);
    InetAddress iAdr2 = Mockito.mock(InetAddress.class);
    Mockito.when(iAdr2.getAddress()).thenReturn(new byte[] { 95, 10, 1, 1 });
    TCPPacket tcpPacket = Mockito.mock(TCPPacket.class);
    Mockito.when(tcpPacket.getSourcePort()).thenReturn(81);
    Mockito.when(tcpPacket.getDestinationPort()).thenReturn(82);
    Mockito.when(tcpPacket.getDestinationIPAddress()).thenReturn(iAdr2);
    Mockito.when(tcpPacket.isSYN()).thenReturn(true);
    Mockito.when(tcpPacket.isFIN()).thenReturn(true);
    Mockito.when(tcpPacket.isRST()).thenReturn(true);
    Mockito.when(tcpPacket.getTimeStamp()).thenReturn(1000d);
    PacketInfo packetInfo2 = Mockito.mock(PacketInfo.class);
    Mockito.when(packetInfo2.getPacket()).thenReturn(tcpPacket);
    Mockito.when(packetInfo2.getDir()).thenReturn(PacketDirection.UPLINK);
    Mockito.when(packetInfo2.getTcpInfo()).thenReturn(TcpInfo.TCP_ESTABLISH);
    Mockito.when(packetInfo2.getPayloadLen()).thenReturn(0);
    Mockito.when(packetInfo2.getLen()).thenReturn(15);
    Mockito.when(packetInfo2.getAppName()).thenReturn("Test2");
    Mockito.when(packetInfo2.getTcpFlagString()).thenReturn("Test2String");
    Mockito.when(packetInfo2.getTimeStamp()).thenReturn(10d);
    TCPPacket tcpPacket2 = Mockito.mock(TCPPacket.class);
    Mockito.when(tcpPacket2.getSourcePort()).thenReturn(95);
    Mockito.when(tcpPacket2.getDestinationPort()).thenReturn(99);
    Mockito.when(tcpPacket2.getDestinationIPAddress()).thenReturn(iAdr2);
    Mockito.when(tcpPacket2.isSYN()).thenReturn(true);
    Mockito.when(tcpPacket2.isFIN()).thenReturn(true);
    Mockito.when(tcpPacket2.isRST()).thenReturn(false);
    Mockito.when(tcpPacket2.getTimeStamp()).thenReturn(50d);
    Inet4Address address = (Inet4Address) InetAddress.getByName("192.168.1.4");
    PacketInfo packetInfo3 = Mockito.mock(PacketInfo.class);
    Mockito.when(packetInfo3.getPacket()).thenReturn(tcpPacket2);
    Mockito.when(packetInfo3.getDir()).thenReturn(PacketDirection.UPLINK);
    Mockito.when(packetInfo3.getTcpInfo()).thenReturn(TcpInfo.TCP_ESTABLISH);
    Mockito.when(packetInfo3.getPayloadLen()).thenReturn(0);
    Mockito.when(packetInfo3.getLen()).thenReturn(15);
    Mockito.when(packetInfo3.getAppName()).thenReturn("Test2");
    Mockito.when(packetInfo3.getTcpFlagString()).thenReturn("Test2String");
    Mockito.when(packetInfo3.getTimeStamp()).thenReturn(10d);
    Mockito.when(packetInfo3.getRemoteIPAddress()).thenReturn(address);
    List<PacketInfo> packetsList = new ArrayList<PacketInfo>();
    // Adding UDP Packet to the list
    packetsList.add(packetInfo1);
    packetsList.add(packetInfo2);
    packetsList.add(packetInfo3);
    Statistic testResult = iPacketAnalyzer.getStatistic(packetsList);
    assertEquals(3, testResult.getTotalPackets());
}