How to change Packet IP from Wireshark file and send all the packets with the new IP

Aug 3, 2012 at 3:30 PM

 

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using PcapDotNet.Core;
using PcapDotNet.Packets;
using PcapDotNet.Packets.IpV4;
using PcapDotNet.Packets.Ethernet;
using PcapDotNet.Packets.Transport;

namespace SendingPacketsUsingSendBuffer
{
    class Program
    {
        static void Main(string[] args)
        {
            // Check the validity of the command line
            if (args.Length == 0 || args.Length > 2)
            {
                //return;
            }

            // Retrieve the device list from the local machine
            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

            if (allDevices.Count == 0)
            {
                Console.WriteLine("No interfaces found! Make sure WinPcap is installed.");
                return;
            }

            // Print the list
            for (int i = 0; i != allDevices.Count; ++i)
            {
                LivePacketDevice device = allDevices[i];
                Console.Write((i + 1) + ". " + device.Name);
                if (device.Description != null)
                    Console.WriteLine(" (" + device.Description + ")");
                else
                    Console.WriteLine(" (No description available)");
            }

            int deviceIndex = 0;
            do
            {
                Console.WriteLine("Enter the interface number (1-" + allDevices.Count + "):");
                string deviceIndexString = Console.ReadLine();
                if (!int.TryParse(deviceIndexString, out deviceIndex) ||
                    deviceIndex < 1 || deviceIndex > allDevices.Count)
                {
                    deviceIndex = 0;
                }
            } while (deviceIndex == 0);

            // Take the selected adapter
            PacketDevice selectedOutputDevice = allDevices[deviceIndex - 1];

            uint bufferSize = uint.MaxValue;

            // Retrieve the length of the capture file
            long capLength = new FileInfo("C:\\smtp_email_with_TO_CC_body_and_10_attach.pcap").Length;

            // Chek if the timestamps must be respected
            bool isSync = (args.Length == 2 && args[1][0] == 's');

            // Open the capture file
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice("C:\\smtp_email_with_TO_CC_body_and_10_attach.pcap");

              // 65536 guarantees that the whole packet will be captured on all the link layers
             // promiscuous mode
            // read timeout
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))// portion of the packet to capture
            {
                using (PacketCommunicator outputCommunicator =  selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    // Allocate a send buffer
                    using (PacketSendBuffer sendBuffer = new PacketSendBuffer((uint)capLength))
                    {
                        // Fill the buffer with the packets from the file
                        int numPackets = 0;
                        Packet packet;
                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                        {
                            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                            PayloadLayer payload = (PayloadLayer)packet.Ethernet.Payload.ExtractLayer();
                            TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                            tcpLayer.Checksum = null;
                            //UdpLayer udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                            //udpLayer.Checksum = null;
                            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                            ipLayer.Destination = new IpV4Address("11.12.13.14");
                            ipLayer.HeaderChecksum = null;
                            Packet newPacket = PacketBuilder.Build(DateTime.Now, ethernet, ipLayer, tcpLayer, payload);
                            //sendBuffer.Enqueue(newPacket);
                            outputCommunicator.SendPacket(newPacket);
                            ++numPackets;
                        }

                        //outputCommunicator.Transmit(sendBuffer, isSync); //Transmit the queue
                    }
                }
            }
        }
    }
}

in this code i am take a Wireshark file and want to change the IP before send it, so for each packet in my buffer i am changing the packet IP, and build the new packet but my problem is after each packet build how can i put the new packets in new buffer and than sending this bufffer ?

 

 

Coordinator
Aug 4, 2012 at 7:23 AM

I assume that things work for you using SendPacket().

 

If you want to send the buffer after each packet, don't use SendBuffer, just use SendPacket (there's no benefit of putting one packet in a send buffer).

You can create a new SendBuffer for each packet if you really want to.

 

If you want to use the SendBuffer for all packet, you should uncomment the Enqueue() and Transmit() calls, and delete the SendPacket() call.

If this doesn't work, try and increase the size of the SendBuffer.

 

I hope this helps,

 

Boaz.

Aug 4, 2012 at 2:42 PM
Edited Aug 4, 2012 at 2:44 PM

Hi,

i prefer to put all the new packets (after the changes i have made) in a new buffer and than send this buffer (all my Wireshark files contain many packets), is it possible for you to show me how to do it ?

regards

Gal.

Coordinator
Aug 4, 2012 at 8:02 PM

Hi Gal,

 

Can you give me some details on what exactly doesn't work for you?

If the SendPacket() works for you, I believe all you need to do is to change it to use the send buffer (and maybe increase its size).

 

Boaz.

Aug 5, 2012 at 7:28 AM
Edited Aug 7, 2012 at 5:53 PM

when i useu SendPacket() (only the relevant code - the other is the same like my first post):

 

                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                        {
                            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                            PayloadLayer payload = (PayloadLayer)packet.Ethernet.Payload.ExtractLayer();
                            TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                            tcpLayer.Checksum = null;
                            //UdpLayer udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                            //udpLayer.Checksum = null;
                            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                            ipLayer.Destination = new IpV4Address("1.2.3.4");
                            ipLayer.HeaderChecksum = null;
                            Packet newPacket = PacketBuilder.Build(DateTime.Now, ethernet, ipLayer, tcpLayer, payload);
                            //sendBuffer.Enqueue(newPacket);
                            outputCommunicator.SendPacket(newPacket);
                            ++numPackets;
                        }

 

the error received is: Failed writing to device. WinPcap Error: send error: PacketSendPacket failed

in the same way i can send the original packet and it's works fine (outputCommunicator.SendPacket(packet))

 

edit:

it's working now using sendPacket.

how can i put all the new packet into new buffer in order to use sendBuffer instead of sendPacket ?

Coordinator
Aug 10, 2012 at 5:48 AM

I'm glad it worked out, what was the problem?

 

Regarding the Send Buffer, did you try simply using Enqueue() ? What doesn't work there?

 

Boaz.

Aug 10, 2012 at 2:23 PM
Edited Aug 10, 2012 at 2:24 PM

Hi Boaz,

now i am using sendBuffer() option and before i am puting the packet into the buffer i am changing the packet ip but still some Wireshark files cause error when i want to send the buffer, this is my code:
StackTrace:
   at PcapDotNet.Core.PacketSendBuffer.Transmit(pcap* pcapDescriptor, Boolean isSync) in c:\users\boaz\tfs\tfs06.codeplex.com\pcapdotnet\pcapdotnet\src\pcapdotnet.core\packetsendbuffer.cpp:line 34   at PcapDotNet.Core.LivePacketCommunicator.Transmit(PacketSendBuffer sendBuffer, Boolean isSync) in c:\users\boaz\tfs\tfs06.codeplex.com\pcapdotnet\pcapdotnet\src\pcapdotnet.core\livepacketcommunicator.cpp:line 25   at SendingPacketsUsingSendBuffer.Program.Main(String[] args) in c:\Users\Gal\Desktop\packets\packets\Program.cs:line 94   at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args)   at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)

 

 

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using PcapDotNet.Core;
using PcapDotNet.Packets;
using PcapDotNet.Packets.IpV4;
using PcapDotNet.Packets.Ethernet;
using PcapDotNet.Packets.Transport;

namespace SendingPacketsUsingSendBuffer
{
    class Program
    {
        public static string FILE_NAME_PCAP = @"C:\Users\Gal\Desktop\first50Packets.pcap";

        static void Main(string[] args)
        {
            // Check the validity of the command line
            if (args.Length == 0 || args.Length > 2)
            {
                //return;
            }

            // Retrieve the device list from the local machine
            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

            if (allDevices.Count == 0)
            {
                Console.WriteLine("No interfaces found! Make sure WinPcap is installed.");
                return;
            }

            // Print the list
            for (int i = 0; i != allDevices.Count; ++i)
            {
                LivePacketDevice device = allDevices[i];
                Console.Write((i + 1) + ". " + device.Name);
                if (device.Description != null)
                    Console.WriteLine(" (" + device.Description + ")");
                else
                    Console.WriteLine(" (No description available)");
            }

            int deviceIndex = 0;
            do
            {
                Console.WriteLine("Enter the interface number (1-" + allDevices.Count + "):");
                string deviceIndexString = Console.ReadLine();
                if (!int.TryParse(deviceIndexString, out deviceIndex) ||
                    deviceIndex < 1 || deviceIndex > allDevices.Count)
                {
                    deviceIndex = 0;
                }
            } while (deviceIndex == 0);

            // Take the selected adapter
            PacketDevice selectedOutputDevice = allDevices[deviceIndex - 1];

            // Retrieve the length of the capture file
            long capLength = new FileInfo(FILE_NAME_PCAP).Length;

            // Chek if the timestamps must be respected
            bool isSync = (args.Length == 2 && args[1][0] == 's');
            //isSync = true;

            // Open the capture file
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(FILE_NAME_PCAP);

            // 65536 guarantees that the whole packet will be captured on all the link layers
            // promiscuous mode
            // read timeout
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))// portion of the packet to capture
            {
                using (PacketCommunicator outputCommunicator = selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    // Allocate a send buffer
                    using (PacketSendBuffer sendBuffer = new PacketSendBuffer((uint)capLength * 2))
                    {
                        // Fill the buffer with the packets from the file
                        Packet packet;
                        Packet tmpPacket = null;

                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                        {
                            tmpPacket = changePacketIp(packet, "192.168.0.100", "1.2.3.4");
                            outputCommunicator.SendPacket(tmpPacket);

                            //if (tmpPacket != null)
                            //{
                                //sendBuffer.Enqueue(tmpPacket);
                            //}
                        }

                        //outputCommunicator.Transmit(sendBuffer, isSync); //Transmit the queue
                    }
                }
            }
        }

        public static Packet changePacketIp(Packet packet, string oldIpAddress, string newIpAddress)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = null;
            Packet newPacket = null;
            TcpLayer tcpLayer = null;
            UdpLayer udpLayer = null;

            if (packet.Ethernet.IpV4.Protocol.ToString() == "Tcp")
            {
                payload = packet.Ethernet.IpV4.Tcp.Payload.ExtractLayer();
                tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipLayer.Source = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipLayer.Destination = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, tcpLayer, payload);
            }
            else if (packet.Ethernet.IpV4.Protocol.ToString() == "Udp")
            {
                payload = packet.Ethernet.IpV4.Udp.Payload.ExtractLayer();
                udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                udpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipLayer.Source = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipLayer.Destination = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, udpLayer, payload);
            }

            return newPacket;
        }
    }
}

both sendBuffer() and sendPacket() crash in the middle of the sending, i can give you the Wireshark example.

Coordinator
Aug 10, 2012 at 4:16 PM

I need some more information.

Please add the full error you get.

Does the exception happens on a specific packet? Can you look at Wireshark and see what is different about this packet? Can you run the application only on this packet and see if it still crashes?

If you're still having problems with SendPacket, please don't use Send Buffer since it adds more complexity.

Aug 10, 2012 at 4:51 PM
Edited Aug 10, 2012 at 4:59 PM

both sendBuffer() and sendPacket() crash in the middle of the sending.

i did not notice something special in the packet, can i send you maybe the Wireshark file ?

i add a link to my Wireshark file (both cause crash):

small part from the big file:

http://netload.in/dateif19Oy5z9iD/first50Packets.pcap.htm

the big file:

http://netload.in/dateitvJUUlQ74G/http2.pcap.htm

 

Gal.

Coordinator
Aug 17, 2012 at 7:25 AM

Hi Gal,

 

After some debugging, I've found out that packet 20 in the "small part from the big file" pcap file is the problematic one.

I believe the problem is that this packet is too long.

Its length is 1552 bytes, while I believe in many cases you can only send 1514 bytes of Ethernet packet.

 

I hope this helps,

 

Boaz.

Aug 17, 2012 at 4:24 PM
Edited Aug 18, 2012 at 5:10 PM

and what you suggest to solve it ?

why in the original file with the original Ip there is no problem when i am sending this packets ?

Gal

Coordinator
Aug 18, 2012 at 8:04 AM

Was this problematic pcap packet sent by the same network device to the network?

Aug 18, 2012 at 8:33 AM
Edited Aug 18, 2012 at 5:10 PM

yes, i can play the both files (first50Packets.pcap and http2.pcap) who contains all the packets to the same network device without any errors.

maybe something in my new packet build is wrong ? 

Gal

Coordinator
Aug 18, 2012 at 2:21 PM

So you can play both packet files as is but when you change them you can't?

Can you put the modified packets in a dump file instead of transmitting them to the network device and then try and play these pcap files?

Then you can see what packet is the problematic one and send it to me, or see what wrong with it.

Aug 18, 2012 at 3:49 PM
Edited Aug 18, 2012 at 5:10 PM

yes, i can play the original pcap files without any errors.

how can i put the modified packets in a dump file ?

Gal

Coordinator
Aug 18, 2012 at 4:54 PM

Take a look at Pcap.Net Tutorial - Handling offline dump files.

You can use PacketDumpFile.Dump() static method.

Aug 18, 2012 at 5:10 PM

can you show me please a short example how to use PacketDumpFile.Dump() in my code ?

Gal

Sep 1, 2012 at 6:37 PM
Edited Sep 1, 2012 at 6:37 PM

i still cannot succeed to understand how to use PacketDumpFile.Dump().

Gal

Coordinator
Sep 7, 2012 at 8:18 AM

Here is an example:

 

Packet expectedPacket = PacketBuilder.Build(DateTime.Now,
                                            new EthernetLayer
                                            {
                                                Source = new MacAddress(1),
                                                Destination = new MacAddress(2),
                                                EtherType = EthernetType.QInQ,
                                            },
                                            new PayloadLayer
                                            {
                                                Data = new Datagram(new byte[] {1, 2, 3})
                                            });
PacketDumpFile.Dump("filename.pcap", DataLinkKind.Ethernet, PacketDevice.DefaultSnapshotLength,
                    new[] {expectedPacket});

Sep 7, 2012 at 3:11 PM
Edited Sep 7, 2012 at 3:33 PM

Thanks !

Gal

Sep 7, 2012 at 4:47 PM
Edited Sep 7, 2012 at 4:47 PM
brickner wrote:

So you can play both packet files as is but when you change them you can't?

Can you put the modified packets in a dump file instead of transmitting them to the network device and then try and play these pcap files?

Then you can see what packet is the problematic one and send it to me, or see what wrong with it.

same results, after save the packets to dump file and than transmitting the program crash after 15 packets.

same as transmitting them to the network device. 

Coordinator
Sep 8, 2012 at 7:04 AM

Can you copy the code and the full exception details and paste them here?

Sep 8, 2012 at 8:10 AM
Edited Sep 8, 2012 at 8:12 AM

code:

 

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using PcapDotNet.Core;
using PcapDotNet.Packets;
using PcapDotNet.Packets.IpV4;
using PcapDotNet.Packets.Ethernet;
using PcapDotNet.Packets.Transport;

namespace SendingPacketsUsingSendBuffer
{
    class Program
    {
        public static string FILE_NAME_PCAP = @"D:\Drivers\Captures\first50Packets.pcap";
        public static string savedFile = @"D:\Drivers\Captures\test.pcap";

        static void Main(string[] args)
        {
            // Check the validity of the command line
            if (args.Length == 0 || args.Length > 2)
            {
                //return;
            }

            // Retrieve the device list from the local machine
            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

            if (allDevices.Count == 0)
            {
                Console.WriteLine("No interfaces found! Make sure WinPcap is installed.");
                return;
            }

            // Print the list
            for (int i = 0; i != allDevices.Count; ++i)
            {
                LivePacketDevice device = allDevices[i];
                Console.Write((i + 1) + ". " + device.Name);
                if (device.Description != null)
                    Console.WriteLine(" (" + device.Description + ")");
                else
                    Console.WriteLine(" (No description available)");
            }

            int deviceIndex = 0;
            do
            {
                Console.WriteLine("Enter the interface number (1-" + allDevices.Count + "):");
                string deviceIndexString = Console.ReadLine();
                if (!int.TryParse(deviceIndexString, out deviceIndex) ||
                    deviceIndex < 1 || deviceIndex > allDevices.Count)
                {
                    deviceIndex = 0;
                }
            } while (deviceIndex == 0);

            // Take the selected adapter
            PacketDevice selectedOutputDevice = allDevices[deviceIndex - 1];

            // Retrieve the length of the capture file
            long capLength = new FileInfo(FILE_NAME_PCAP).Length;

            // Chek if the timestamps must be respected
            bool isSync = (args.Length == 2 && args[1][0] == 's');
            //isSync = true;

            // Open the capture file
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(FILE_NAME_PCAP);

            // 65536 guarantees that the whole packet will be captured on all the link layers
            // promiscuous mode
            // read timeout
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))// portion of the packet to capture
            {
                using (PacketCommunicator outputCommunicator = selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    // Allocate a send buffer
                    using (PacketSendBuffer sendBuffer = new PacketSendBuffer((uint)capLength * 2))
                    {
                        // Fill the buffer with the packets from the file
                        Packet packet;
                        Packet tmpPacket = null;
                        List<Packet> packetList = new List<Packet>();

                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                        {
                            tmpPacket = changePacketIp(packet, "192.168.0.100", "1.2.3.4");
                            //tmpPacket = changeMacAddress(packet, new MacAddress("00:25:9c:cf:ec:01"), new MacAddress("00:11:22:33:44:55"));
                            
                            //if (tmpPacket != null)
                            //{
                            //outputCommunicator.SendPacket(tmpPacket);
                            //}                                 

                            if (tmpPacket != null)
                            {
                                packetList.Add(tmpPacket);
                                sendBuffer.Enqueue(tmpPacket);
                            }
                        }

                        PacketDumpFile.Dump(savedFile, DataLinkKind.Ethernet, PacketDevice.DefaultSnapshotLength, packetList);

                        playCapture(selectedOutputDevice, @"D:\Drivers\Captures\test.pcap");

                        //outputCommunicator.Transmit(sendBuffer, isSync); //Transmit the queue
                    }
                }
            }
        }
        
        public static Packet changePacketIp(Packet packet, string oldIpAddress, string newIpAddress)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = null;
            Packet newPacket = null;
            TcpLayer tcpLayer = null;
            UdpLayer udpLayer = null;

            if (packet.Ethernet.IpV4.Protocol.ToString() == "Tcp")
            {
                payload = packet.Ethernet.IpV4.Tcp.Payload.ExtractLayer();
                tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipLayer.Source = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipLayer.CurrentDestination = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, tcpLayer, payload);
            }
            else if (packet.Ethernet.IpV4.Protocol.ToString() == "Udp")
            {
                payload = packet.Ethernet.IpV4.Udp.Payload.ExtractLayer();
                udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                udpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipLayer.Source = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipLayer.CurrentDestination = new IpV4Address(newIpAddress);
                    ipLayer.HeaderChecksum = null;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, udpLayer, payload);
            }

            return newPacket;
        }

        public static Packet changePacketPort(Packet packet, ushort oldPort, ushort newPort)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = null;
            Packet newPacket = null;
            TcpLayer tcpLayer = null;
            UdpLayer udpLayer = null;

            if (packet.Ethernet.IpV4.Protocol.ToString() == "Tcp")
            {
                payload = packet.Ethernet.IpV4.Tcp.Payload.ExtractLayer();
                tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Tcp.SourcePort == oldPort)
                {
                    tcpLayer.SourcePort = newPort;
                }
                else if (packet.Ethernet.IpV4.Tcp.DestinationPort == oldPort)
                {
                    tcpLayer.DestinationPort = newPort;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, tcpLayer, payload);
            }
            else if (packet.Ethernet.IpV4.Protocol.ToString() == "Udp")
            {
                payload = packet.Ethernet.IpV4.Udp.Payload.ExtractLayer();
                udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                udpLayer.Checksum = null;

                if (packet.Ethernet.IpV4.Tcp.SourcePort == oldPort)
                {
                    udpLayer.SourcePort = newPort;
                }
                else if (packet.Ethernet.IpV4.Tcp.DestinationPort == oldPort)
                {
                    udpLayer.DestinationPort = newPort;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, udpLayer, payload);
            }

            return newPacket;
        }

        public static Packet changeMacAddress(Packet packet, MacAddress oldMacAddress, MacAddress newMacAddress)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = null;
            Packet newPacket = null;
            TcpLayer tcpLayer = null;
            UdpLayer udpLayer = null;

            if (packet.Ethernet.IpV4.Protocol.ToString() == "Tcp")
            {
                payload = packet.Ethernet.IpV4.Tcp.Payload.ExtractLayer();
                tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
                tcpLayer.Checksum = null;

                if (packet.Ethernet.Destination == oldMacAddress)
                {
                    ethernet.Destination = newMacAddress;
                }
                else if (packet.Ethernet.Source == oldMacAddress)
                {
                    ethernet.Source = newMacAddress;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, tcpLayer, payload);
            }
            else if (packet.Ethernet.IpV4.Protocol.ToString() == "Udp")
            {
                payload = packet.Ethernet.IpV4.Udp.Payload.ExtractLayer();
                udpLayer = (UdpLayer)packet.Ethernet.IpV4.Udp.ExtractLayer();
                udpLayer.Checksum = null;

                if (packet.Ethernet.Destination == oldMacAddress)
                {
                    ethernet.Destination = newMacAddress;
                }
                else if (packet.Ethernet.Source == oldMacAddress)
                {
                    ethernet.Source = newMacAddress;
                }

                newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipLayer, udpLayer, payload);
            }

            return newPacket;
        }

        public static void playCapture(PacketDevice device, string filePath)
        {
            bool isSync = false;
            long capLength = new FileInfo(filePath).Length;
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(filePath);

            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))// portion of the packet to capture
            {
                using (PacketCommunicator outputCommunicator = device.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    using (PacketSendBuffer sendBuffer = new PacketSendBuffer((uint)capLength * 2))
                    {
                        // Fill the buffer with the packets from the file
                        Packet packet;

                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                        {
                            sendBuffer.Enqueue(packet);
                        }

                        outputCommunicator.Transmit(sendBuffer, isSync); //Transmit the queue
                    }
                }
            }
        }
    }
}

this is the screenshot after the crash, in this code i am transmitting the packets from pcap file on the computer and like the previous one the program transmitting only 15 packets (the file contain 50)

http://i47.tinypic.com/14xgwax.jpg

Coordinator
Sep 8, 2012 at 8:39 AM

Can you run it in debug and give me the full exception details?

Sep 8, 2012 at 8:51 AM

i am running it in debug but no exeption only the screenshot.

maybe you can run it on your machine with this file: http://netload.in/dateif19Oy5z9iD/first50Packets.pcap.htm

just foloow the code, change the packets ip and you will reproduce the crash.


Coordinator
Sep 8, 2012 at 8:54 AM

Please run it in debug in VS2010 and mark:

1. Debug -> Exceptions -> Common Language Runtime Exceptions -> Thrown

2. Debug -> Exceptions -> Common Language Runtime Exceptions -> User-unhandled

 

When you catch the exception, copy its details by clicking the copy details link and paste it here.

Sep 8, 2012 at 8:59 AM
Edited Sep 8, 2012 at 8:59 AM

i am with visual 2012 and changed what you told me to but again no Exceptions, only crash with this error: http://i47.tinypic.com/14xgwax.jpg

Coordinator
Sep 8, 2012 at 9:00 AM

Are you running it with F5 or Ctrl-F5?

You should run it with F5.
Sep 8, 2012 at 9:01 AM

i am running with F5

Coordinator
Sep 8, 2012 at 9:02 AM

ok, so try and find out what is the location where the code crashes.

You can do this by printing log lines.

Sep 8, 2012 at 9:05 AM

can you explain me how to do it ?

Coordinator
Sep 8, 2012 at 9:14 AM

Gal, There are different ways to debug an application.

For more information, check out different articles like the following:

http://support.microsoft.com/kb/815788

http://csharp.net-tutorials.com/debugging/introduction/

http://www.csharp-station.com/Articles/DebuggingTechniques.aspx

http://www.youtube.com/watch?v=QCPt9aOcd98

 

In general, I suggest not using PacketSendBuffer before everything else works well for you.

Try and find the root cause of the problem in Pcap.Net so I can debug it.

When you have a more specific issue than "the following full application code crashes" I might be able to help.

 

I hope this helps,

 

Boaz.

Sep 8, 2012 at 9:23 AM
Edited Sep 8, 2012 at 9:24 AM

after try the option sendPacket() again the application crash after few packet but this time with exception.

stack trace:    at PcapDotNet.Core.PacketCommunicator.SendPacket(Packet packet) in c:\tfs\tfs06.codeplex.com\pcapdotnet\pcapdotnet\src\pcapdotnet.core\packetcommunicator.cpp:line 247, 

this will help you to debug or you need more details ?

Coordinator
Sep 8, 2012 at 9:26 AM

I think you are still creating a packet which is too big.

Check the packet you're trying to send's length.

Sep 8, 2012 at 9:31 AM

don't forget that the original file with same packets transmitted fine.

Coordinator
Sep 8, 2012 at 9:47 AM

Try and create file with exactly two packets, one that transmitted fine and another that fails.

Look in Wireshark what is the difference between them.

Sep 8, 2012 at 10:00 AM
Edited Sep 8, 2012 at 10:02 AM

i did not see any differences, maybe you will see:

2.pcap - the original file

test.pcap - the file who crash the application (in this file a have change the packets ip address), the first packet transmitted fine, the second crash

http://www.2shared.com/file/R4piq1Vt/Captures.html

Coordinator
Sep 8, 2012 at 10:06 AM

So if you transmit 2.pcap everything works well and if you transmit test.pcap to the same network device it crashes?

Sep 8, 2012 at 10:07 AM

Yes.

Coordinator
Sep 8, 2012 at 10:13 AM

In test.pcap, the PacketSizeLimit is 65536 while in 2.pcap it is 65535.

Can you change test.pcap to be with the same size limit is 2.pcap?

Sep 8, 2012 at 12:27 PM

where ?

Coordinator
Sep 8, 2012 at 1:54 PM

When creating the pcap file, you can set the Snapshot length.

Sep 8, 2012 at 2:39 PM
Edited Sep 8, 2012 at 2:40 PM

where can i choose the length ? 

PacketDumpFile.Dump(savedFile, DataLinkKind.Ethernet, PacketDevice.DefaultSnapshotLength, packetList);

Coordinator
Sep 8, 2012 at 2:52 PM

Just replace PacketDevice.DefaultSnapshotLength

Sep 8, 2012 at 3:07 PM

still crash (both 65535 and 65536)

Coordinator
Sep 8, 2012 at 3:08 PM

Send me the new pcap files.

Please make sure you put both in the working file and in the non working file only one packet.

Sep 8, 2012 at 3:16 PM
Edited Sep 8, 2012 at 3:20 PM

the old pcap files in this link: http://www.2shared.com/file/R4piq1Vt/Captures.html that i send before

Sep 8, 2012 at 3:19 PM
Edited Sep 8, 2012 at 3:23 PM

the new pcap file: http://www.sendspace.com/file/b4whkm with Snapshot length 65535 (crash in the second packet)

Sep 13, 2012 at 10:07 AM

did you find what's the issue ?

Coordinator
Sep 14, 2012 at 10:45 AM

"Please make sure you put both in the working file and in the non working file only one packet" (and make sure it actually crashes only in one of them).

Sep 14, 2012 at 1:16 PM

Hi,

i did not understand you want me to send you.

Coordinator
Sep 15, 2012 at 8:56 AM

Two Pcap files.

Each should contain ONE packet.

Both should be with the same snapshot length.

One should crash the send and the other shouldn't.

Sep 15, 2012 at 10:04 AM
Edited Sep 15, 2012 at 10:06 AM

maybe there is different problem, i took original capture with 26 packet in order to isolate the problematic packet so i have check first what packet cause the crash and after sending all the packets successfully with both sendPacket and sendBuffer there is a crash.

this is my file: http://www.2shared.com/file/9TljTP_A/26_online.html

my code:

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using PcapDotNet.Core;
using PcapDotNet.Packets;
using PcapDotNet.Packets.IpV4;
using PcapDotNet.Packets.Ethernet;
using PcapDotNet.Packets.Transport;

namespace SendingPacketsUsingSendBuffer
{
    class Program
    {
        public static string oldFile = @"D:\Drivers\Captures\26.pcap";
        //public static string newFile = @"D:\Drivers\Captures\test.pcap";

        static void Main(string[] args)
        {

            if (args.Length == 0 || args.Length > 2) //Check the validity of the command line
            {
                //return;
            }

            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine; //Retrieve the device list from the local machine

            if (allDevices.Count == 0)
            {
                Console.WriteLine("No interfaces found! Make sure WinPcap is installed.");
                return;
            }

            for (int i = 0; i != allDevices.Count; ++i) //Print the list
            {
                LivePacketDevice device = allDevices[i];
                Console.Write((i + 1) + ". " + device.Name);
                if (device.Description != null)
                    Console.WriteLine(" (" + device.Description + ")");
                else
                    Console.WriteLine(" (No description available)");
            }

            int deviceIndex = 0;
            do
            {
                Console.WriteLine("Enter the interface number (1-" + allDevices.Count + "):");
                string deviceIndexString = Console.ReadLine();
                if (!int.TryParse(deviceIndexString, out deviceIndex) ||
                    deviceIndex < 1 || deviceIndex > allDevices.Count)
                {
                    deviceIndex = 0;
                }
            } while (deviceIndex == 0);

            PacketDevice selectedOutputDevice = allDevices[deviceIndex - 1]; //Take the selected adapter
            long capLength = new FileInfo(oldFile).Length; //Retrieve the length of the capture file
            bool isSync = (args.Length == 2 && args[1][0] == 's'); //Chek if the timestamps must be respected
            //isSync = true;

            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(oldFile); //Open the capture file

            // 65536 guarantees that the whole packet will be captured on all the link layers
            // promiscuous mode
            // read timeout
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000)) //portion of the packet to capture
            {
                using (PacketCommunicator outputCommunicator = selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    // Allocate a send buffer
                    using (PacketSendBuffer sendBuffer = new PacketSendBuffer((uint)capLength * 2))
                    {
                        Packet packet;
                        Packet tmpPacket = null;
                        List<Packet> packetList = new List<Packet>();

                        while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok) //Fill the buffer with the packets from the file
                        {

                            outputCommunicator.SendPacket(packet);

                        }
                    }
                }
            }
        }
Coordinator
Sep 17, 2012 at 7:44 AM

Please catch the exception and print it so we can see why does it crash.