Fix bad checksum packet

May 23, 2013 at 2:44 PM
Edited May 23, 2013 at 2:58 PM
is this the current way to Fix bad checksum packet:
        private Packet fixBadChecksum(Packet packet)
        {
            try
            {
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer();
                DateTime packetTimestamp = packet.Timestamp;
                ipV4Layer.HeaderChecksum = null;

                return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);
            }
            catch (Exception)
            {
                return null;
            }
        }
Attach link to 2 pcap file, before (with 50 packets with bad checksum) and after fix bad checksum, as you can see it didn't succeed to fix those packets.

http://www.sendspace.com/filegroup/OfvklmrH52B4Ny1Sngsf5w
Coordinator
May 31, 2013 at 7:39 AM
All of the packets in the After file seem to have correct IPv4 checksum.
Can you specify which packets don't have correct IPv4 checksum?
May 31, 2013 at 9:50 AM
Edited May 31, 2013 at 9:50 AM
As you can see Before.pcap contain 513 packets include 50 packets with bad checksum and After.pcap contain only 463 packets because this function didnt succeed to fix those 50 packets so it cannot be transmitted.
Am i doing something wrong ?
Coordinator
May 31, 2013 at 10:04 AM
Do you mean that the function threw an exception?
Can you give me a specific example for a packet where this didn't work and what did this method do? What exception was thrown?
May 31, 2013 at 10:05 AM
its strange because when i am save this file into dump file (and fix it before )it save all the 513 packets but still transmitted only 613 packets.
Coordinator
May 31, 2013 at 10:07 AM
ok, so the problem is different I guess.
May 31, 2013 at 10:12 AM
Edited May 31, 2013 at 10:12 AM
The function did not threw an exception.
All the relevant packets with the bad checksum is in the file in this link: http://www.sendspace.com/filegroup/OfvklmrH52B4Ny1Sngsf5w
just download the file BeforeFix.pcap and after open this file with Wireshark add the filter ip.checksum_bad==1 and you will see all the 50 packets with the bad checksum.
May 31, 2013 at 10:16 AM
Edited May 31, 2013 at 10:16 AM
In my code before add Packet to Buffer i am call packet = fixChecksum(packet);
fixChecksum is my function who fix the checksum (see my first message here) and after received new packet i am add this packet into my Buffer
Coordinator
May 31, 2013 at 10:16 AM
ok, so what happened to the 50 packets you fixed?
Where did they go?
If there are no exceptions, what are you doing with the resulted packets?

I think it's best to try and debug this on one packet alone.
Coordinator
May 31, 2013 at 10:19 AM
Can you show me how the packets look like if you save them to file instead of trying to transmit them?
May 31, 2013 at 10:23 AM
Edited May 31, 2013 at 10:29 AM
Failed transmiting packets from queue. WinPcap Error: Error opening adapter: Error opening adapter: Error opening adapter: Error

Ok this is the StackTrace from OutputCommunicator.Transmit(mSendBuffer, _isBurst);: at PcapDotNet.Core.PacketSendBuffer.Transmit(pcap* pcapDescriptor, Boolean isSync)
at PcapDotNet.Core.LivePacketCommunicator.Transmit(PacketSendBuffer sendBuffer, Boolean isSync)
at packetPlayer.Pcap.playCapture(PacketDevice packetDevice) in d:\Drivers\PacketPlayer__\MyApplication\classes\Pcap.cs:line 275
May 31, 2013 at 10:25 AM
Edited May 31, 2013 at 10:28 AM
This is 1 packet after the fix and save as you ask: http://www.sendspace.com/file/mkpf3h
Coordinator
May 31, 2013 at 10:25 AM
I don't understand, do you get an exception? How is this stack trace helpful?

I suggest you just try to save a single packet and not transmit it and see how it looks like in a pcap file.
May 31, 2013 at 10:36 AM
Edited May 31, 2013 at 10:38 AM
That is what i did now.
this link: http://www.sendspace.com/file/mkpf3h contain 1 packets that successfully save after the fix (only save without send)

when try to send this packet with the bad checksum and after this packet pass my fixBadChecksum function - i get an exception in OutputCommunicator.Transmit
Coordinator
May 31, 2013 at 10:54 AM
Using Transmit() can be a bit tricky.
Can you first try and use the simple SendPacket() method to see if this works?
May 31, 2013 at 11:01 AM
Still the same error
May 31, 2013 at 11:32 AM
Any solution ?
Coordinator
Jun 1, 2013 at 6:34 AM
Can you give the full exception description with the full call stack when you use OutputCommunicator?
Jun 1, 2013 at 6:51 AM
Edited Jun 1, 2013 at 7:14 AM
InvalidOperationException was caught

InnerException: null

Message: Failed transmiting packets from queue. WinPcap Error: Error opening adapter: Error opening adapter: Error opening adapter: Error

StackTrace: at PcapDotNet.Core.PacketSendBuffer.Transmit(pcap* pcapDescriptor, Boolean isSync)
at PcapDotNet.Core.LivePacketCommunicator.Transmit(PacketSendBuffer sendBuffer, Boolean isSync)
at packetPlayer.Pcap.sendBuffer(PacketDevice packetDevice) in d:\Drivers\projects\MyApplication\classes\Pcap.cs:line 287
Coordinator
Jun 1, 2013 at 1:36 PM
According to the call stack, it seems you're using Transmit() and not SendPacket().
Please change it to SendPacket() so it's easier to debug.
Also, I'll need to take a look at the code you run and not just the packet creation method.
Jun 1, 2013 at 2:44 PM
Edited Jun 1, 2013 at 2:53 PM
After change to SendPacket:

nvalidOperationException was caught
InnerException: null
Message: Failed writing to device. Packet length: 2974. WinPcap Error: send error: PacketSendPacket failed
StackTrace: at PcapDotNet.Core.PacketCommunicator.SendPacket(Packet packet)
at packetPlayer.Pcap.sendBuffer(PacketDevice packetDevice) in d:\Drivers\projects\PacketPlayer\PacketPlayer\classes\Pcap.cs:line 288

i would say that the packet length is the reason ?

this is my code (moved some irrelevant code):
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice("MyFile");
            PacketDevice selectedOutputDevice; //my interface 

            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
            {
                using (PacketCommunicator mOutputCommunicator = selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    Packet packet;

                    while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok) //fill the buffer with the packets from the file
                    {
                        using (PacketSendBuffer mSendBuffer = new PacketSendBuffer((uint)packet.Length * 4))
                        {
                            try
                            {
                                mOutputCommunicator.SendPacket(packet);
                            }
                            catch (Exception ex)
                            {

                            }
                        }
                    }
                }
            }
Coordinator
Jun 7, 2013 at 11:47 AM
Packet length does seems suspicious large.

It also seems that the original packets with the bad checksum are also very large.
It's possible that you can't send such large packets with your device.

Boaz.
Jun 7, 2013 at 2:30 PM
Edited Jun 7, 2013 at 2:32 PM
NO because i have check it with several machines and on all those machine the result was the same.
Did you try to send it on yours machine ?
Coordinator
Jun 8, 2013 at 7:02 AM
Have you seen such large packets go out from these machines?
Jun 8, 2013 at 8:11 AM
I checked now with another computer and it seems that it works fine.
can you show me how to check and see this large packets ?
because this packets comes from VMware machine and maybe i can change the packet size, what is the packet limit that network card could send ?
Coordinator
Jun 8, 2013 at 10:06 AM
Usually Ethernet packet size don't exceed 1514 bytes (14 bytes for Ethernet header and 1500 for payload).
Jun 8, 2013 at 12:02 PM
Edited Jun 8, 2013 at 12:06 PM
So why this large packets has bad checkum ?

This is the way to check packet size ?

Image
Coordinator
Jun 14, 2013 at 1:53 PM
I don't know why.
And yes, this is a good way to check it.