This project is read-only.

is it possible to split packet into 2 smaller packets during send buffer ?

Mar 27, 2012 at 3:34 PM
Edited Mar 27, 2012 at 3:34 PM

i use pcap file and play all the packets inside to network card and i wonder it its possible

 

thanks

Coordinator
Mar 30, 2012 at 6:28 PM

It is possible.

Please note that the packets might not get to their destination if the devices on the way don't find them appropriate.

May 2, 2012 at 12:25 PM

Hi bricker,

Please can you give the code sample to split the packet to more then one?

 

Coordinator
May 4, 2012 at 7:47 AM

It really depends how you want to split it.

You can obviously just break the packet by taking different parts of its bytes and build different packets.

But this would probably won't achieve much.

On what level (e.g. Ethernet, IPv4, TCP) do you want to split the packets and why?

Aug 9, 2012 at 4:22 PM

i want to split the packet in the data of course, all the others parameters should remain the same (ip's, ports etc)

i saw the parameter fragment and i think this is the option but i don't know how to use it.

Coordinator
Aug 10, 2012 at 6:42 AM

If I understand correctly, you want to fragment the packet on the IPv4 level.

I suggest you read a bit about IP fragmentation, for example here: http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly

Pcap.Net allows you to control the different fragmentation fields so you can create two packets that hold the fragmented data.

 

I hope this helps,

 

Boaz.

Sep 20, 2012 at 11:08 AM

can you show me please a simple example how to use it ?

Coordinator
Sep 28, 2012 at 1:30 PM

I suggest you look at examples of fragmented packets and recreate them using Pcap.Net to know how to do it.

Sep 28, 2012 at 3:31 PM

where i can fine this examples ?

Coordinator
Sep 29, 2012 at 8:53 PM

Maybe this one?

http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=teardrop.cap

Oct 5, 2012 at 1:38 PM

can i have an code example please ?

Coordinator
Oct 7, 2012 at 2:20 PM

I don't have any examples written.

I suggest you try to follow the Wireshark fields and let me know if you have a specific problem.

Oct 7, 2012 at 3:53 PM

my problem is that i don't know how to start, which field should i change ?

Coordinator
Oct 12, 2012 at 7:58 AM

IpV4Layer.Fragmentation property handles the fragmentation properties.

Oct 31, 2012 at 10:21 PM
Edited Nov 7, 2012 at 4:13 PM

this is the write way to do it ?

    public IEnumerable<Packet> splitPacket(Packet packet)
    {
        EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
        IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
        DateTime packetTimestamp = packet.Timestamp;
        ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
        IpV4Fragmentation.Equals(packet, packet);

        yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);
    }

Coordinator
Nov 23, 2012 at 7:43 PM

No, where do you fragment here?

This line does nothing: IpV4Fragmentation.Equals(packet, packet);

You should create a new IPv4Layer and provide it custom IpV4Fragmentation instance.

Nov 24, 2012 at 8:45 AM
Edited Nov 30, 2012 at 8:12 AM

i have split TCP packet into 2 packets and with Wireshark check this 2 packets and one of them was TCP and the second ipv4, is it normal ?

        public static IEnumerable<Packet> splitPacket(Packet packet, int numberOfFragments)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
            DateTime packetTimestamp = packet.Timestamp;
            ipV4Layer.HeaderChecksum = null;

            PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data
            var totalLength = payload.Length;
            var partialLength = totalLength / numberOfFragments; //split data into smaller segments

            partialLength = (partialLength / 8) * 8; //make sure it's divisible with 8 (see http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly)

            ushort offset = 0; //send one by one
            while (offset < totalLength)
            {
                int fragmentLength = partialLength; //get length for this fragment
                IpV4FragmentationOptions options = IpV4FragmentationOptions.MoreFragments;

                if (offset + fragmentLength >= totalLength) //is this the last fragment ? trim length if needed
                {
                    options = IpV4FragmentationOptions.None;
                    fragmentLength = totalLength - offset;
                }
                
                byte[] newBuffer = ipV4Datagram.Payload.ToArray(); //copy the actual data into a new buffer
                PayloadLayer newPayload = new PayloadLayer { Data = new Datagram(newBuffer, offset, fragmentLength) };

                //ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset); //change IP layer fragmentation options
                //IpV4Fragmentation ipFragmentation = new IpV4Fragmentation(options, offset);
                ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset);
                yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, newPayload); //return it

                offset += (ushort)fragmentLength; //next offset
            }
        }

Coordinator
Dec 1, 2012 at 8:11 PM

Since you don't give a TCP layer when you call PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, newPayload); it makes sense you won't get a TCP packet in the second packet.

Dec 2, 2012 at 11:18 AM
Edited Dec 3, 2012 at 5:36 AM
now it's OK it just i have checksum error on each packet although i have tcpLayer.Checksum = null; 
        public IEnumerable<Packet> splitPacket(Packet packet, int numberOfFragments)
        {
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;

            if (ipV4Datagram.Protocol == IpV4Protocol.Tcp || ipV4Datagram.Protocol == IpV4Protocol.Udp)
            {
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                ILayer layer = packet.Ethernet.IpV4.ExtractLayer();
                TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;                
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                ipV4Layer.HeaderChecksum = null;
                
                DateTime packetTimestamp = packet.Timestamp;                
                PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data
                int totalLength = payload.Length;
                int partialLength = totalLength / numberOfFragments; //split data into smaller segments
                partialLength = (partialLength / 8) * 8; //make sure it's divisible with 8
                //(http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly)
                ushort offset = 0; //send one by one

                while (offset < totalLength)
                {
                    int fragmentLength = partialLength; //get length for this fragment
                    IpV4FragmentationOptions options = IpV4FragmentationOptions.MoreFragments;

                    if (offset + fragmentLength >= totalLength) //is this the last fragment ? trim length if needed
                    {
                        options = IpV4FragmentationOptions.None;
                        fragmentLength = totalLength - offset;
                    }

                    byte[] newBuffer = ipV4Datagram.Payload.ToArray(); //copy the actual data into a new buffer
                    PayloadLayer newPayload = new PayloadLayer { Data = new Datagram(newBuffer, offset, fragmentLength) };
                    ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset); //change IP layer fragmentation options
                    yield return PacketBuilder.Build(packetTimestamp, ethernet, layer, tcpLayer, ipV4Layer, newPayload); //return
                    offset += (ushort)fragmentLength; //next offset
                }
            }

        }

Coordinator
Dec 3, 2012 at 9:46 PM

Can you give the pcap file so I'll try and understand the problem?

Dec 4, 2012 at 9:38 AM
Edited Dec 4, 2012 at 7:43 PM

http://www.filedropper.com/tcp

also this pcap file cause crash in this function and i dont understans why: http://www.filedropper.com/10packets

Coordinator
Dec 7, 2012 at 2:02 PM

Regarding the 10packets, the reason it crashes is because you're trying to extract a TCP layer from a UDP packet.

Running your code only on TCP packets work and you get a valid TCP checksum.

Dec 7, 2012 at 2:34 PM
Edited Dec 7, 2012 at 2:38 PM

i checked again the file tcp.pcap and the new 2 packets is with checksum error, please see the pcap file after the fragmentation: http://www.filedropper.com/afterfrag

Regarding the 10packets: what you suggest ? how to fix it ?

Coordinator
Dec 7, 2012 at 2:37 PM
Edited Dec 7, 2012 at 2:37 PM

I thought you meant the TCP checksum.

The IP checksum is wrong because you set 

ipV4Layer.HeaderChecksum = null;

However, you use layer, and not ipV4Layer in

PacketBuilder.Build(packetTimestamp, ethernet, layer, tcpLayer, ipV4Layer, newPayload);
Dec 7, 2012 at 2:46 PM
Edited Dec 7, 2012 at 2:47 PM

ipV4Layer.HeaderChecksum = null; removed.

and with PacketBuilder.Build(packetTimestamp, ethernet, tcpLayer, ipV4Layer, newPayload); i did not get any packet

Coordinator
Dec 7, 2012 at 2:47 PM

Why did you disable it, you should just use it instead of layer.

Dec 7, 2012 at 2:53 PM

i am sorry but now i am confuse.

this is my code now: PacketBuilder.Build(packetTimestamp, ethernet, tcpLayer, ipV4Layer, newPayload);

and the line ipV4Layer.HeaderChecksum = null; in my code again.

can you show me please the correct way to do it ?

Coordinator
Dec 7, 2012 at 2:54 PM

How about

PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer, newPayload);

?

Dec 7, 2012 at 2:57 PM
Edited Dec 7, 2012 at 2:59 PM

i already try it.

working but only one tcp packet, and the second is ipv4 packet

see the output: http://www.filedropper.com/after_1

Coordinator
Dec 7, 2012 at 3:00 PM

Can you try and debug your code line by line and see what is going on?

Dec 7, 2012 at 3:03 PM
Edited Dec 7, 2012 at 3:04 PM

it's get into the first if, get into the while but skip the if statement inside the while and then return.

Dec 8, 2012 at 5:16 PM

the problem is in my code ?

Coordinator
Dec 8, 2012 at 8:30 PM
psptst1 wrote:

the problem is in my code ?

Until proven otherwise :)

Dec 8, 2012 at 9:14 PM
Edited Dec 8, 2012 at 9:20 PM

this is my method, and this is the pcap link file before the fragmentation and this is after the fragmentation, you can see currently the output of the tcp packet is TCP and ipv4 packet and the function is as you told me to use, can you please help me to solve it ?

private IEnumerable<Packet> splitPacket(Packet packet, int numberOfFragments)
        {
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;

            if (ipV4Datagram.Protocol == IpV4Protocol.Tcp || ipV4Datagram.Protocol == IpV4Protocol.Udp)
            {
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                ILayer layer = packet.Ethernet.IpV4.ExtractLayer();
                TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                ipV4Layer.HeaderChecksum = null;
                DateTime packetTimestamp = packet.Timestamp;
                PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data
                int totalLength = payload.Length;
                int partialLength = totalLength / numberOfFragments; //split data into smaller segments
                ushort offset = 0; //send one by one

                while (offset < totalLength)
                {
                    int fragmentLength = partialLength; //get length for this fragment
                    IpV4FragmentationOptions options = IpV4FragmentationOptions.MoreFragments;

                    if (offset + fragmentLength >= totalLength) //is this the last fragment ? trim length if needed
                    {
                        options = IpV4FragmentationOptions.None;
                        fragmentLength = totalLength - offset;
                    }

                    byte[] newBuffer = ipV4Datagram.Payload.ToArray(); //copy the actual data into a new buffer
                    PayloadLayer newPayload = new PayloadLayer { Data = new Datagram(newBuffer, offset, fragmentLength) };
                    ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset); //change IP layer fragmentation options
                    yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, newPayload); //return
                    offset += (ushort)fragmentLength; //next offset
                }
            }

        }
Coordinator
Dec 9, 2012 at 8:19 PM

Why do you call packet.Ethernet.IpV4.Tcp on UDP packets?

Dec 9, 2012 at 8:23 PM
Edited Dec 9, 2012 at 8:27 PM

in this case is it matter ? (my file contain TCP packet)

how should i handle it if i cannot know in advance if my packet is TCP or UDP ?

btw i did not use packet.Ethernet.IpV4.Tcp in packat.Builder

Coordinator
Dec 9, 2012 at 8:35 PM

That's why you get a TCP packet and an IPv4 packet.

If you don't give a TCP layer, why do you expect the packet to be TCP?

Dec 9, 2012 at 8:39 PM

in this case: yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer, newPayload); i am still received TCP and IPV4 packets.

Coordinator
Dec 9, 2012 at 8:58 PM

Why do you give fragmentation None to all packets?

Dec 9, 2012 at 9:01 PM
Edited Dec 9, 2012 at 9:01 PM

i took this code from stackoverflow after you confirm this method:

http://stackoverflow.com/questions/13272565/split-packet-into-2-packets-with-pcapdotnet

Coordinator
Dec 10, 2012 at 6:58 AM

Quoting myself:

"

Indeed looks like a good start. You should probably put MoreFragments on all segments but the last one. Also, it seems this won't cover the entire original packet because of rounding issues, but this can be debugged and fixed easily.

"

Dec 10, 2012 at 6:43 PM

i have try but honesty i don't have enough knowledge to do it.

can i have help with this issue ?

 

Coordinator
Dec 28, 2012 at 4:33 PM

I suggest you read http://en.wikipedia.org/wiki/IP_fragmentation and follow the relevant links and RFCs for more information.

After you know what packets you need to send, let me know if you need help with building the right packets using Pcap.Net