using System.Net;
namespace Utils.ETW.Models;
///
/// 网络事件公共数据结构定义
///
public class NetworkEventData
{
///
/// 记录产生时间
///
public DateTime Timestamp { get; set; }
///
/// 事件类型
///
public string EventType { get; set; }
///
/// 进程 ID
///
public int ProcessId { get; set; }
public int ThreadId { get; set; }
public string ProcessName { get; set; }
public IPAddress SourceIp { get; set; }
public IPAddress DestinationIp { get; set; }
///
/// 源端口
///
public int SourcePort { get; set; }
///
/// 目标端口
///
public int DestinationPort { get; set; }
public string Protocol { get; set; }
public int DataLength { get; set; }
public TrafficDirection Direction { get; set; } // Inbound/Outbound
public Dictionary AdditionalProperties { get; set; }
public NetworkEventData()
{
AdditionalProperties = new Dictionary();
}
}
///
/// TCP 连接数据配置
///
public class TcpConnectionSession : NetworkEventData
{
public long ConnectionId { get; set; }
///
/// 开始时间
///
public DateTime StartTime { get; set; }
public DateTime? EndTime { get; set; }
///
/// 发送的字节数
///
public long BytesSent { get; set; }
public long BytesReceived { get; set; }
///
/// 持续时间
///
public TimeSpan Duration => (EndTime ?? DateTime.Now) - StartTime;
public List Events { get; set; } = new List();
}
///
/// TCP连接事件数据
///
public class TcpConnectionEventData : NetworkEventData
{
///
/// 连接状态
///
public string ConnectionState { get; set; } // ESTABLISHED, CLOSED, LISTEN等
public long ConnectionId { get; set; }
///
/// 顺序
///
public int SequenceNumber { get; set; }
public int AcknowledgmentNumber { get; set; }
public int WindowSize { get; set; }
public string TcpFlags { get; set; }
}
///
/// UDP数据包事件数据
///
public class UdpPacketEventData : NetworkEventData
{
public int UdpLength { get; set; }
public int Checksum { get; set; }
}
// DNS查询事件数据
public class DnsEventData : NetworkEventData
{
public string QueryName { get; set; }
public string QueryType { get; set; }
public string ResponseCode { get; set; }
public List ResolvedAddresses { get; set; }
public int QueryId { get; set; }
public DnsEventData()
{
ResolvedAddresses = new List();
}
}
// HTTP事件数据
public class HttpEventData : NetworkEventData
{
public string HttpMethod { get; set; }
public string Url { get; set; }
public int StatusCode { get; set; }
public string UserAgent { get; set; }
public string Host { get; set; }
public Dictionary Headers { get; set; }
public long ContentLength { get; set; }
public HttpEventData()
{
Headers = new Dictionary();
}
}
// 网络接口事件数据
public class NetworkInterfaceEventData : NetworkEventData
{
public string InterfaceName { get; set; }
public string InterfaceType { get; set; }
public string MacAddress { get; set; }
public string InterfaceState { get; set; } // Up/Down
public long BytesSent { get; set; }
public long BytesReceived { get; set; }
public long PacketsSent { get; set; }
public long PacketsReceived { get; set; }
}
// 网络错误事件数据
public class NetworkErrorEventData : NetworkEventData
{
public int ErrorCode { get; set; }
public string ErrorDescription { get; set; }
public string ErrorCategory { get; set; }
}