Oakrey.Network.Abstractions 2.0.3

Oakrey.Network.Abstractions

A .NET library providing foundational abstractions for parsing and working with raw network packets. It covers the Ethernet, network (IPv4/IPv6), and transport (TCP/UDP) layers through a layered class hierarchy, and exposes strongly-typed protocol enumerations, address range types, and byte-level formatting utilities.

The library is used as a shared contract layer across other Oakrey.Network.* packages.

Features

Packet header parsing

Layer abstractions

PacketDescriptionBase
  NetworkLayerBase        (IAddress, IpProtocol)
    IPv4PacketHead
    IPv6PacketHead
  TransportLayerBase      (IPorts)
    TcpHeader
    UdpHeader
MacPacketHead             (IAddress)

Protocol enumerations

• EtherType - full IEEE-assigned EtherType registry (IPv4, IPv6, ARP, VLAN, MPLS, PPPoE, and more).
• IpProtocol - full IANA IP protocol number registry (ICMP, TCP, UDP, IGMP, GRE, OSPF, and more).
• IPType - IP version discriminator.
• FlagsEnum - TCP flag bits (SYN, ACK, FIN, RST, PSH, URG).

Address and range types

• IpAddressRange - defines a scannable IPv4 address range (three fixed octets + start/stop for the last octet). Constructors accept octet values, System.Net.IPAddress, or a "x.x.x.start-stop" string.
• IpAddressRangeViewModel - INotifyPropertyChanged wrapper over IpAddressRange for WPF/MVVM binding.
• IAddress - common interface exposing Source and Destination strings.
• IPorts - common interface exposing SourcePort and DestinationPort.

Raw packet interface

IRawPacket represents a captured frame with:

• Data - raw byte array.
• LinkLayerType - PacketDotNet.LinkLayers value.
• TimeValue - capture timestamp.
• GetPayload() / GetPayloadString() - helpers to extract the application payload beyond the standard 74-byte header.

Utilities

• Formatter - extension methods on byte[] for reading MAC addresses, IPv4/IPv6 addresses, uint16/uint32 values (big-endian), and EtherType.
• TimeValue - lightweight struct (seconds + microseconds) matching the pcap timestamp layout, with a TimeSpan conversion.

Architecture

classDiagram
    class IRawPacket {
        +byte[] Data
        +LinkLayers LinkLayerType
        +TimeValue TimeValue
        +GetPayload() byte[]
        +GetPayloadString() string
    }

    class PacketDescriptionBase {
        +byte[] Payload
        +int PayloadSize
        +TimeValue TimeStamp
        +int TotalPacketSize
        #byte[] header
        #int HeaderSize
    }

    class MacPacketHead {
        +string Source
        +string Destination
        +EtherType Type
        +bool IsIPv4
        +bool IsIPv6
    }

    class NetworkLayerBase {
        +string Source
        +string Destination
        +IpProtocol Protocol
    }

    class IPv4PacketHead {
        +byte TTL
        +byte DSCP
        +byte ECN
        +short FragmentOffset
        +uint HeaderChecksum
    }

    class IPv6PacketHead {
        +byte HopLimit
        +byte NextHeader
        +uint PayloadLength
        +byte[] FlowLabel
    }

    class TransportLayerBase {
        +ushort SourcePort
        +ushort DestinationPort
    }

    class TcpHeader {
        +uint Seq
        +uint Ack
        +ushort WindowSize
        +FlagsEnum Flags
        +ushort Checksum
    }

    class UdpHeader {
        +ushort Length
        +ushort Checksum
    }

    PacketDescriptionBase <|-- MacPacketHead
    PacketDescriptionBase <|-- NetworkLayerBase
    PacketDescriptionBase <|-- TransportLayerBase
    NetworkLayerBase <|-- IPv4PacketHead
    NetworkLayerBase <|-- IPv6PacketHead
    TransportLayerBase <|-- TcpHeader
    TransportLayerBase <|-- UdpHeader
    IRawPacket --> MacPacketHead : parsed by

Requirements

• .NET 10 or higher

Installation

NuGet Package Manager

1. Open Visual Studio.
2. Go to Tools > NuGet Package Manager > Manage NuGet Packages for Solution.
3. Search for Oakrey.Network.Abstractions and click Install.

.NET CLI

dotnet add package Oakrey.Network.Abstractions

Package Manager Console

Install-Package Oakrey.Network.Abstractions

Example usage

The typical usage pattern is to parse a raw captured frame layer by layer.

// rawPacket implements IRawPacket (e.g. from Oakrey.Network.PacketCapture)

MacPacketHead mac = new(rawPacket);
Console.WriteLine(mac);  // src: AA:BB:CC:DD:EE:FF -> dst: 11:22:33:44:55:66 (IPv4)

if (mac.IsIPv4)
{
    IPv4PacketHead ipv4 = new(mac);
    Console.WriteLine(ipv4); // src: 192.168.1.1 -> dst: 192.168.1.2 (TCP)

    if (ipv4.Protocol == IpProtocol.TCP)
    {
        TcpHeader tcp = new(ipv4);
        Console.WriteLine(tcp); // src: 54321 -> dst: 80 (seq=..., ack=..., flags=ACK)

        byte[] payload = tcp.Payload;
    }
    else if (ipv4.Protocol == IpProtocol.UDP)
    {
        UdpHeader udp = new(ipv4);
        Console.WriteLine(udp); // src: 5353 -> dst: 5353 (length=...)
    }
}

Scanning an IPv4 address range:

// Scan 192.168.1.1 - 192.168.1.254
IpAddressRange range = new(ipPart3: 192, ipPart2: 168, ipPart1: 1, ipPart0Start: 1, ipPart0Stop: 254);

// Or construct from a string
IpAddressRange range2 = new("192.168.1.1-254");

// Or from an existing address (last octet becomes 0-255)
IpAddressRange range3 = new(IPAddress.Parse("192.168.1.100"));

Development notes

• All header classes read directly from the raw byte[] without copying. Parsing is zero-allocation beyond the header slice.
• Formatter extension methods handle big-endian byte order as used on the wire.
• TimeValue is a blittable struct compatible with the pcap / npcap timestamp layout.
• IpAddressRangeViewModel depends on WPF via INotifyPropertyChanged; avoid using it in non-UI projects.

License

MIT - Copyright (c) Oakrey 2016-present

• Repository: Azure DevOps
• NuGet: Oakrey.Network.Abstractions

6. Contributing

Contributions are welcome! Feel free to open issues or submit pull requests to improve the package.

7. License

This project is licensed under the MIT License. See the LICENSE file for details.