how to remove Vlan and PPPOE layer from packet

Sep 24, 2012 at 12:14 PM
Edited Sep 24, 2012 at 12:15 PM

Hi Boaz,

some of my Wireshark files contain Vlans or PPPOE packets (differents files), is it posibble to buid new packet without those layers ?

if it possible i will glad for shot code example.

Gal. 

Coordinator
Sep 28, 2012 at 12:32 PM

PPPoE protocol isn't currently supported in Pcap.Net.

 

For VLAN tagging (802.1Q), you can try to recreate the packet without this layer.

 

Boaz.

Sep 28, 2012 at 2:30 PM

what layer should i ignore ?

Coordinator
Sep 29, 2012 at 7:52 PM

The VLAN tagging one?

Oct 4, 2012 at 7:00 PM

i don't know how to find this Tag, can i have an example ?

Coordinator
Oct 5, 2012 at 10:39 AM

If you have a VLAN tagged packet, you would probably have IPv4 over VLAN over Ethernet.

So the EthernetLayer can be extracted by packet.Ethernet.ExtractLayer();

The VLanTaggedFrameLayer can be extracted by packet.Ethernet.VLanTaggedFrame.ExtractLayer();

The IpV4Layer can be extracted by packet.Ethernet.VLanTaggedFrame.IpV4.ExtractLayer();

 

I hope this helps,

 

Boaz.

Oct 5, 2012 at 8:02 PM
Edited Oct 5, 2012 at 8:03 PM

i need to extract the payload too ?

        public static Packet removeVlan(Packet packet)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.VLanTaggedFrame.IpV4.ExtractLayer();
            ILayer vlanLayer = packet.Ethernet.VLanTaggedFrame.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            Packet newPacket = null;

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer);

            return newPacket;
        }

Coordinator
Oct 7, 2012 at 1:21 PM

If you want to keep the payload you will need to put it in the PacketBuilder.

Oct 7, 2012 at 2:44 PM
Edited Oct 7, 2012 at 4:33 PM

i received something strange, this is my code who remove the Vlan:

 

        public static Packet removeVlan(Packet packet)
        {
            ILayer ethernet = packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.VLanTaggedFrame.IpV4.ExtractLayer();
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            ILayer vlanLayer = packet.Ethernet.VLanTaggedFrame.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            Packet newPacket = null;

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);

            return newPacket;
        }

the original file and the file after (both files contains only 1 packet): http://www.freefilehosting.net/desktop 

but if i am changing the way how i am extract the Etherner layer to packet.Ethernet.VLanTaggedFrame.ExtractLayer(); First layer (PcapDotNet.Packets.Ethernet.VLanTaggedFrameLayer) must provide a DataLink error received.

Coordinator
Oct 12, 2012 at 6:56 AM

You should put the VLanTaggerFrameLayer after the EthernetLayer in the PacketBuilder.

Oct 12, 2012 at 12:24 PM
Edited Oct 12, 2012 at 12:26 PM

i already extracted ILayer ethernet = packet.Ethernet.VLanTaggedFrame.ExtractLayer();

how can i extract the vlan Layer ?

i have try and didn't find any property how return VLanTaggerFrameLayer 

Coordinator
Oct 13, 2012 at 8:51 AM

These are two different layers:

ILayer ethernet = packet.Ethernet.ExtractLayer();

ILayer vlan = packet.Ethernet.VLanTaggedFrame.ExtractLayer();

 

When you use the PacketBuilder, you should use both.

Oct 13, 2012 at 11:49 AM
Edited Oct 13, 2012 at 11:50 AM

please see this pcap file: http://www.freefilehosting.net/vlan_1 

how should i handle packets like packet number 44 ?

how can i ignore this packet ?

        public static Packet removeVlan(Packet packet)
        {
            ILayer ethernet = packet.Ethernet.ExtractLayer();
            ILayer vlan = packet.Ethernet.VLanTaggedFrame.ExtractLayer();
            IDataLink dataLink = packet.DataLink;
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.VLanTaggedFrame.IpV4.ExtractLayer();
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();           
            DateTime packetTimestamp = packet.Timestamp;
            ipV4Layer.HeaderChecksum = null;

            return PacketBuilder.Build(packetTimestamp, ethernet, vlan, ipV4Layer, payload);
        }

Coordinator
Nov 23, 2012 at 7:32 PM

Do you want to ignore the packets or the layers?

What packets exactly do you want to ignore?