[HaBo]

class pvampTCPInspector
    {
        pvampDB DB;
        Hashtable Connections_SynSent = new Hashtable();
        Hashtable Connections_All = new Hashtable();
        Hashtable SynFromSource = new Hashtable();
        int min_time_for_syncheck = 5;
        int max_syn_for_source = 5;
        DateTime LastSynCheck = DateTime.Parse("01.01.1900");

        public pvampTCPInspector(pvampDB pDB)
        {
            DB = pDB;
        }
        public void putPacket(TCPPacket  P)
        {
            TimeSpan TimeBetweenLastSynCheck = DateTime.Now - LastSynCheck;
            if (TimeBetweenLastSynCheck.TotalSeconds > min_time_for_syncheck)
            {
                // it's time for a check for half open connections
                // for each recognized syn sender do so
                foreach (DictionaryEntry DE in SynFromSource)
                {
                    int syncount = 0;
                    // for each target connection of the syn sender do
                    foreach (DictionaryEntry SubDE in (Hashtable)DE.Value)
                    {
                        // get the associated connection and count new entries since last check
                        TCPConnection ThisConnection = (TCPConnection)SubDE.Value;
                        TimeSpan connection_alive_since_sec = 
                            DateTime.Now - ThisConnection.Created;
                        if (connection_alive_since_sec <= TimeBetweenLastSynCheck)
                        {
                            syncount++;
                        }
                    }  
                    if (syncount > max_syn_for_source)
                    {
                        Console.WriteLine("handle: tcp: tcp-syn-portscan possible");
                    }
                }
            }

            TCPConnection Connection = GetTCPConnection(P);
            if (Connection == null)
            {
                // this TCP Connection isn't present
                if (P.Syn && !P.Ack)
                {
                    // this may be a normal connection attempt
                    // Create the Connection object and link it from connections_all
                    // and connection_SynSent, synfromsource association
                    
                    string PK = Helper.TCP_ConnectionPK(P);
                    Connections_All[PK] = new TCPConnection(
                        P.SourceAddress.ToString(), P.DestinationAddress.ToString(),
                        P.SourcePort, P.DestinationPort,P.SequenceNumber );
                    Connections_SynSent[PK] = (TCPConnection)Connections_All[PK];
                    Console.WriteLine("handle: tcp: syn for connection " + PK);

                    // Create a syn table, 
                    // if acual source protoadress has not accured yet in this context
                    if (SynFromSource[P.SourceAddress.ToString()] == null)
                        SynFromSource[P.SourceAddress.ToString()] = new Hashtable();
                    // Subdevide structure to SourceIP in toplevel and the target parameters in sublevel
                    Hashtable SubEntries = (Hashtable)SynFromSource[P.SourceAddress.ToString()];
                    string SubPK = string.Format("{0}|{1}",
                        P.DestinationAddress.ToString(),
                        P.DestinationPort .ToString());
                    SubEntries[SubPK] = (TCPConnection)Connections_All[PK];
                }
                else
                {
                    // this connection may be alive since a time before pvamp started
                }
            }
            else
            {
                TCPConnectionState ChangeEvent= Connection.putPacket(P);
                // When receiving a synack or rst, the syn entries should be erased
                if (ChangeEvent == TCPConnectionState.SynAckReceived
                    | ChangeEvent == TCPConnectionState.RstReceived  )
                {
                    SynFromSource.Remove(Connection.SourceIP );
                    Console.WriteLine("handle: tcp: removed " + 
                        Connection.SourceIP  + " from syncheck table");
                }
            }
            
        }

        TCPConnection GetTCPConnection(TCPPacket P)
        {
            if (Connections_All[P.SourceAddress.ToString() + "|"
                + P.SourcePort.ToString() + "|"
                + P.DestinationAddress.ToString() + "|"
                + P.DestinationPort.ToString()] != null)
            {
                return (TCPConnection)Connections_All[
                    P.SourceAddress.ToString() + "|" + P.SourcePort.ToString() + "|" + 

P.DestinationAddress.ToString() + "|" + P.DestinationPort.ToString()];
            }
            else if (Connections_All[P.DestinationAddress.ToString() + "|"
                + P.DestinationPort.ToString() + "|"
                + P.SourceAddress.ToString() + "|"
                + P.SourcePort.ToString()] != null)
            {
                return (TCPConnection)Connections_All[
                    P.DestinationAddress.ToString() + "|" + P.DestinationPort.ToString() + "|" + 

P.SourceAddress.ToString() + "|" + P.SourcePort.ToString()];
            }
            else
                return null;
        }
    }