Skip to content

Commit a8e1439

Browse files
Malcolm-StewartMalcolm-Stewart
authored
Merge pull request #47 from microsoft/20220923_ServerClosesFirst
20220923 server closes first
2 parents e3981eb + 937b5e6 commit a8e1439

File tree

11 files changed

+603
-47
lines changed

11 files changed

+603
-47
lines changed

‎SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/.suo‎

6.5 KB
Binary file not shown.

‎SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide‎

8 KB
Binary file not shown.

‎SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide-shm‎

0 Bytes
Binary file not shown.

‎SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide-wal‎

0 Bytes
Binary file not shown.

‎SQL_Network_Analyzer/SQLNA/ConversationData.cs‎

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@ public class ConversationData // - constructed in Get
7575
public int resetCount = 0; // - accumulated in ParseTCPFrame - can be in combination with other flags
7676
public int synCount = 0; // - accumulated in ParseTCPFrame - can be in combination with other flags
7777
public int finCount = 0; // - accumulated in ParseTCPFrame - can be in combination with other flags
78+
public bool hasClientFin = false; // - set in ParseTCPFrame
79+
public bool hasServerFin = false; // - set in ParseTCPFrame
80+
public bool hasServerFinFirst = false; // - set in ParseTCPFrame - used to determine whether the server closed the conversation
7881
public int smpSynCount = 0; // - accumulated in ParseTCPFrame
7982
public int smpAckCount = 0; // - accumulated in ParseTCPFrame
8083
public int smpFinCount = 0; // - accumulated in ParseTCPFrame
@@ -202,7 +205,7 @@ public bool hasLoginFailure // TODO this needs work one of the OR-ed flags b
202205
}
203206
else
204207
{
205-
if (hasApplicationData == true && synCount == 0 && hasPrelogin == false && hasPreloginResponse == false &&
208+
if (hasApplicationData == true && synCount == 0 && hasPrelogin == false && hasPreloginResponse == false &&
206209
hasClientSSL == false && hasServerSSL == false && hasKeyExchange == false && hasCipherExchange == false &&
207210
hasNTLMChallenge == false && hasNTLMResponse == false && frames.Count > (4 + 2 * keepAliveCount + rawRetransmits))
208211
{
@@ -220,6 +223,20 @@ public bool hasLoginFailure // TODO this needs work one of the OR-ed flags b
220223
}
221224
}
222225

226+
//
227+
// Did this conversation even manage to contact the server, let alone login.
228+
// Needs at least one SYN packet to show the start of the conversation.
229+
// Cannot have any PUSH flags for application payload.
230+
// ACK + RESET + FIN are optionally allowed
231+
//
232+
public bool hasSynFailure
233+
{
234+
get
235+
{
236+
return (synCount > 0 && pushCount ==0);
237+
}
238+
}
239+
223240
public long LoginDelay(string step, long firstFrameTick) // times are in ticks, if prior packet time is unknown - timed to start of trace
224241
{
225242
long notPresent = (long)(-1 * utility.TICKS_PER_MILLISECOND); // this value means a blank in the report instead of a 0.
@@ -245,7 +262,7 @@ public bool hasLoginFailure // TODO this needs work one of the OR-ed flags b
245262
if (SSPITime != 0) priorTick = SSPITime;
246263
if (step == "NC") return NTLMChallengeTime == 0 ? notPresent : NTLMChallengeTime - priorTick;
247264
if (NTLMChallengeTime != 0) priorTick = NTLMChallengeTime;
248-
if (step == "NR") return NTLMResponseTime == 0 ? notPresent : NTLMResponseTime-priorTick;
265+
if (step == "NR") return NTLMResponseTime == 0 ? notPresent : NTLMResponseTime - priorTick;
249266
if (NTLMResponseTime != 0) priorTick = NTLMResponseTime;
250267
if (step == "LA") return LoginAckTime == 0 ? notPresent : LoginAckTime - priorTick;
251268
if (LoginAckTime != 0) priorTick = LoginAckTime;
@@ -376,12 +393,43 @@ public string loginFlags
376393
(hasNTLMChallenge ? "NC " : " ") +
377394
(hasNTLMResponse ? "NR " : " ") +
378395
(hasSSPI ? "SS " : " ") +
379-
(ErrorTime !=0 ? "ER" : " ");
396+
(ErrorTime != 0 ? "ER" : " ");
380397

381398
return s;
382399
}
383400
}
384401

402+
public string GetPacketList(int start, int length)
403+
{
404+
string s = "";
405+
for (int i = start; i < start + length; i++) s += ((FrameData)frames[i]).PacketTypeAndDirection + " ";
406+
return s.TrimEnd();
407+
}
408+
409+
public string GetLastPacketList(int length)
410+
{
411+
if (length > frames.Count)
412+
{
413+
return GetPacketList(0, frames.Count);
414+
}
415+
else
416+
{
417+
return GetPacketList(frames.Count - length, length);
418+
}
419+
}
420+
421+
public string GetFirstPacketList(int length)
422+
{
423+
if (length > frames.Count)
424+
{
425+
return GetPacketList(0, frames.Count);
426+
}
427+
else
428+
{
429+
return GetPacketList(0, length);
430+
}
431+
}
432+
385433
public string ColumnHeader1()
386434
{
387435
string s = "";

‎SQL_Network_Analyzer/SQLNA/FrameData.cs‎

Lines changed: 79 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,33 @@ namespace SQLNA
1818
// Should probably be in a side collection in each regular frame, so we do not bloat the conversation itself.
1919
//
2020

21+
public enum FrameType
22+
{
23+
PreLogin = 1, // set in ProcessTDS
24+
PreLoginResponse, // set in ProcessTDS
25+
ClientHello, // set in ProcessTDS
26+
ServerHello, // set in ProcessTDS
27+
KeyExchange, // set in ProcessTDS
28+
CipherChange, // set in ProcessTDS
29+
ApplicationData, // set in ProcessTDS
30+
Login7, // set in ProcessTDS - we should never see this in the raw, should be ApplicationData instead
31+
SSPI, // set in ProcessTDS
32+
NTLMChallenge, // set in ProcessTDS
33+
NTLMResponse, // set in ProcessTDS
34+
LoginAck, // set in ProcessTDS
35+
LoginError, // set in ProcessTDS
36+
Attention, // set in ProcessTDS
37+
SQLBatch, // set in ProcessTDS
38+
RPCRequest, // set in ProcessTDS
39+
XactMgrRequest, // set in ProcessTDS
40+
XActMgrReply, // placeholder
41+
CommandError, // set in ProcessTDS
42+
TabularResponse, // set in ProcessTDS
43+
SMPAck, // set in ParseTCPFrame
44+
SMPSyn, // set in ParseTCPFrame
45+
SMPFin // set in ParseTCPFrame
46+
}
47+
2148
public class FrameData // constructed in ParseOneFile
2249
{
2350
public ConversationData conversation = null; // set in ParseIPV4Frame and ParseIPV6Frame
@@ -36,6 +63,7 @@ public class FrameData // constructed in ParseOne
3663
public ushort smpSession = 0; // set in ParseTCPFrame
3764
public byte smpType = 0; // set in ParseTCPFrame
3865
public byte[] payload = null; // set in ParseTCPFrame and ParseUDPFrame
66+
public FrameType frameType = 0; // set in ProcessTDS
3967
public bool isKeepAliveRetransmit = false; // set in FindKeepAliveRetransmits
4068
public ushort kaRetransmitCount = 0; // set in FindKeepAliveRetransmits
4169
public bool isRetransmit = false; // set in FindRetransmits
@@ -106,6 +134,51 @@ public bool hasRESETFlag
106134
get { return (flags & (byte)TCPFlag.RESET) != 0; }
107135
}
108136

137+
public string PacketType
138+
{
139+
get
140+
{
141+
switch (frameType)
142+
{
143+
case FrameType.ApplicationData: return "AD";
144+
case FrameType.Attention: return "ATTN";
145+
case FrameType.CipherChange: return "CE";
146+
case FrameType.ClientHello: return "CH";
147+
case FrameType.CommandError: return "ERR";
148+
case FrameType.KeyExchange: return "KE";
149+
case FrameType.Login7: return "L7";
150+
case FrameType.LoginAck: return "LA";
151+
case FrameType.LoginError: return "ER";
152+
case FrameType.NTLMChallenge: return "NC";
153+
case FrameType.NTLMResponse: return "NR";
154+
case FrameType.PreLogin: return "PL";
155+
case FrameType.PreLoginResponse: return "PR";
156+
case FrameType.RPCRequest: return "RPC";
157+
case FrameType.ServerHello: return "SH";
158+
case FrameType.SMPAck: return "SmpA";
159+
case FrameType.SMPFin: return "SmpF";
160+
case FrameType.SMPSyn: return "SmpS";
161+
case FrameType.SQLBatch: return "BAT";
162+
case FrameType.SSPI: return "SS";
163+
case FrameType.TabularResponse: return "DATA";
164+
case FrameType.XactMgrRequest: return "TX";
165+
default:
166+
{
167+
if (isKeepAlive) return "KA";
168+
return FormatFlags("");
169+
};
170+
}
171+
}
172+
}
173+
174+
public string PacketTypeAndDirection
175+
{
176+
get
177+
{
178+
return (isFromClient ? ">" : "<") + PacketType;
179+
}
180+
}
181+
109182

110183
public string ColumnHeader1()
111184
{
@@ -163,14 +236,14 @@ public string ColumnData()
163236
}
164237
}
165238

166-
public string FormatFlags()
239+
public string FormatFlags(string filler = ".")
167240
{
168241
string s = "";
169-
s += ((flags & (byte)TCPFlag.ACK) != 0) ? "A" : ".";
170-
s += ((flags & (byte)TCPFlag.PUSH) != 0) ? "P" : ".";
171-
s += ((flags & (byte)TCPFlag.RESET) != 0) ? "R" : ".";
172-
s += ((flags & (byte)TCPFlag.SYN) != 0) ? "S" : ".";
173-
s += ((flags & (byte)TCPFlag.FIN) != 0) ? "F" : ".";
242+
s += ((flags & (byte)TCPFlag.ACK) != 0) ? "A" : filler;
243+
s += ((flags & (byte)TCPFlag.PUSH) != 0) ? "P" : filler;
244+
s += ((flags & (byte)TCPFlag.RESET) != 0) ? "R" : filler;
245+
s += ((flags & (byte)TCPFlag.SYN) != 0) ? "S" : filler;
246+
s += ((flags & (byte)TCPFlag.FIN) != 0) ? "F" : filler;
174247
return s;
175248
}
176249

0 commit comments

Comments
 (0)