Update pcap4j to v2.0.0-alpha to get access to packet timestamps (and possibly TCP...

diff --git a/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_main.iml b/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_main.iml
index 91357ca0762092e180b0ccc860d88f9c943ab9f1..802e727eb81d81a2a8f7888fba69c05b073e89c6 100644 (file)
--- a/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_main.iml
+++ b/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_main.iml
@@ -9,8 +9,8 @@
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-core:1.7.3" level="project" />
-    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-packetfactory-static:1.7.3" level="project" />
+    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-core:2.0.0-alpha" level="project" />
+    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-packetfactory-static:2.0.0-alpha" level="project" />
     <orderEntry type="library" name="Gradle: org.slf4j:slf4j-jdk14:1.8.0-beta2" level="project" />
     <orderEntry type="library" name="Gradle: net.java.dev.jna:jna:4.2.1" level="project" />
     <orderEntry type="library" name="Gradle: org.slf4j:slf4j-api:1.8.0-beta2" level="project" />

diff --git a/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_test.iml b/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_test.iml
index ce4e54ad25384b37864842300cc30be86f00fe19..98985cef83b7ac3c02d3f661091c07870c6c8251 100644 (file)
--- a/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_test.iml
+++ b/Code/Projects/SmartPlugDetector/.idea/modules/SmartPlugDetector_test.iml
@@ -10,8 +10,8 @@
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />
     <orderEntry type="module" module-name="SmartPlugDetector_main" />
-    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-core:1.7.3" level="project" />
-    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-packetfactory-static:1.7.3" level="project" />
+    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-core:2.0.0-alpha" level="project" />
+    <orderEntry type="library" name="Gradle: org.pcap4j:pcap4j-packetfactory-static:2.0.0-alpha" level="project" />
     <orderEntry type="library" name="Gradle: org.slf4j:slf4j-jdk14:1.8.0-beta2" level="project" />
     <orderEntry type="library" name="Gradle: junit:junit:4.11" level="project" />
     <orderEntry type="library" name="Gradle: net.java.dev.jna:jna:4.2.1" level="project" />

diff --git a/Code/Projects/SmartPlugDetector/build.gradle b/Code/Projects/SmartPlugDetector/build.gradle
index ad98b35368d6e1b15a4a997873f504a45c9b0608..582dede51c21bff9d053398930ecd1f0c7479905 100644 (file)
--- a/Code/Projects/SmartPlugDetector/build.gradle
+++ b/Code/Projects/SmartPlugDetector/build.gradle
@@ -16,8 +16,10 @@ dependencies {
     testCompile group: 'junit', name: 'junit', version: '4.11'
 
     // pcap4j
-    compile 'org.pcap4j:pcap4j-core:1.7.3'
-    compile 'org.pcap4j:pcap4j-packetfactory-static:1.7.3'
+    // Updated to v2 alpha as the stable release does not include packet timestamps
+    // v2 should add support for TCP session reassembly as well, although it does not appear to be part of the lib yet.
+    compile 'org.pcap4j:pcap4j-core:2.0.0-alpha'
+    compile 'org.pcap4j:pcap4j-packetfactory-static:2.0.0-alpha'
 
     // pcap4j logging dependency
     compile 'org.slf4j:slf4j-jdk14:1.8.0-beta2'

diff --git a/Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/FlowPatternFinder.java b/Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/FlowPatternFinder.java
index df4d44769668ade3c0d9170b49718a1140d58e0a..c8f8fe27f5e72e122a97298979ff95c15fca3ef1 100644 (file)
--- a/Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/FlowPatternFinder.java
+++ b/Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/FlowPatternFinder.java
@@ -3,11 +3,13 @@ package edu.uci.iotproject;
 import org.pcap4j.core.NotOpenException;
 import org.pcap4j.core.PcapHandle;
 import org.pcap4j.core.PcapNativeException;
+import org.pcap4j.core.PcapPacket;
 import org.pcap4j.packet.IpV4Packet;
 import org.pcap4j.packet.Packet;
 import org.pcap4j.packet.TcpPacket;
 
 import java.io.EOFException;
+import java.time.Instant;
 import java.util.*;
 import java.util.concurrent.TimeoutException;
 
@@ -19,7 +21,7 @@ import java.util.concurrent.TimeoutException;
 public class FlowPatternFinder {
 
     private final Map<String, Set<String>> dnsMap;
-    private final Map<Conversation, List<Packet>> connections = new HashMap<>();
+    private final Map<Conversation, List<PcapPacket>> connections = new HashMap<>();
 
     public FlowPatternFinder(Map<String, Set<String>> dnsMap) {
         this.dnsMap = Objects.requireNonNull(dnsMap);
@@ -31,7 +33,8 @@ public class FlowPatternFinder {
     public void findFlowPattern(PcapHandle pcap, FlowPattern pattern)
             throws PcapNativeException, NotOpenException, TimeoutException {
         try {
-            Packet packet;
+            PcapPacket packet;
+
             while ((packet = pcap.getNextPacketEx()) != null) {
 
                 // For now, we only work support pattern search in TCP over IPv4.
@@ -62,7 +65,7 @@ public class FlowPatternFinder {
                 // TODO: this is strictly not sufficient to differentiate one TCP session from another, but should suffice for now.
                 Conversation conversation = fromClient ? new Conversation(srcAddress, srcPort, dstAddress, dstPort) :
                         new Conversation(dstAddress, dstPort, srcAddress, srcPort);
-                List<Packet> listWrappedPacket = new ArrayList<>();
+                List<PcapPacket> listWrappedPacket = new ArrayList<>();
                 listWrappedPacket.add(packet);
                 // Create new conversation entry, or append packet to existing.
                 connections.merge(conversation, listWrappedPacket, (v1, v2) -> {
@@ -78,7 +81,7 @@ public class FlowPatternFinder {
 
     private void find(FlowPattern pattern) {
         for (Conversation con : connections.keySet()) {
-            List<Packet> packets = connections.get(con);
+            List<PcapPacket> packets = connections.get(con);
             if (packets.size() != pattern.getPacketOrder().size()) {
                 // Not a complete match if different number of packets.
                 continue;
@@ -92,7 +95,10 @@ public class FlowPatternFinder {
                 }
             }
             if (completeMatch) {
-                System.out.println(String.format("found a complete match for %s", pattern.getPatternId()));
+                PcapPacket firstPacketInFlow = packets.get(0);
+                System.out.println(
+                        String.format("[ detected a complete match of pattern '%s' at %s]",
+                                pattern.getPatternId(), firstPacketInFlow.getTimestamp().toString()));
             }
         }
     }