This project is read-only.

Packet defragmantation

Dec 13, 2010 at 6:28 AM

I am trying to defragment packets manually with some data substitution in payload.And I am experiencing two problem now.

One is due the fact that after extracting the initial constructing an artificial UdpDatagram layer with combined Payload (from multiple packets) the checksum does not get calculated correctly.

I found this thread: http://pcapdotnet.codeplex.com/Thread/View.aspx?ThreadId=73724 but it seams that the answer is no longer valid (most likely due to the changes to the API).

Also I do not see how to change the fragmentation field in the IPLayer. This is my code to illustrate:

    static Packet GeneratePacket(Packet srcPacket, byte[] udpPayloadExtraData)
    {
        EthernetLayer eLayer = (EthernetLayer)srcPacket.Ethernet.ExtractLayer();
        IpV4Layer ipLayer = (IpV4Layer)srcPacket.Ethernet.IpV4.ExtractLayer();
        UdpLayer udpLayer = (UdpLayer)srcPacket.Ethernet.IpV4.Udp.ExtractLayer();
                
        var buff = new List<byte>();
        buff.AddRange(srcPacket.Ethernet.IpV4.Udp.Payload.ToArray());
        buff.AddRange(udpPayloadExtraData);

        var payloadLayer = (PayloadLayer)new Datagram(buff.ToArray()).ExtractLayer();

        //cannot change read-only property 
        //ipLayer.Fragmentation.Options = IpV4FragmentationOptions.None;
        
        PacketBuilder builder = new PacketBuilder(eLayer, ipLayer, udpLayer, payloadLayer);
        return builder.Build(srcPacket.Timestamp);
    }

Thank you

Dec 13, 2010 at 6:57 AM

For your first problem, first note that there are two checksums you probably want to recalculate - the IPv4 Header checksum and the UDP checksum.

In order to make the PacketBuilder recalculate the checksums you simply need to set the layers' checksum properties to null.

The API has indeed changed since the discussion you mention.

 

For your second problem, you simply need to set the Fragmentation property instead of the Fragmentation.Options property.

 

Boaz.

Dec 13, 2010 at 1:06 PM

Thank you. With your help the problem now is solved.

------------------------------------------------------------------------------

Let me congratulate you  with such an excellent product and equally excellent support.