PacketCommunicator speed performance

Jan 6, 2014 at 10:20 AM
Edited Jan 6, 2014 at 10:22 AM
I've set up a TAP-Win32 Adapter V9 interface on which I'm running a test.
I've made a small test program that does the following using the Pcap.Net library:
  • puts up the TAP interface
  • configures it with an IP address:
  • connects to NPF driver of the TAP interface
  • captures packets that have the destination IP (random IP that I will ping)
  • takes the source Ethernet address and sets it as a destination in the packet
  • swaps the source IP ( with the destination IP (
  • and sends it back on he TAP interface
    Basically it responds to ICMP requests on
I run the app, then I run CMD and type ping -t It works but the problem is that every response is 2 seconds delayed. Why is this happening?

Here is the code and here are the ping test results.
Jan 6, 2014 at 9:12 PM
Edited Jan 6, 2014 at 9:13 PM
I figured it out. It's because I didn't change the ICMP message type from Echo Request(1) to Echo Reply(0). I was just taking the IP packet swap the IP addresses and send it back. So what happened was:
  • host sends an ICMP request to app
  • app sends back the ICMP request
  • host waits 2 seconds timeout, interprets my ICMP request as a reply, and sends a reply to my retransmitted request
The problem is that IcmpLayer class has the MessageType property read-only, so I had to hand craft the ICMP datagram:
byte[] buffer = packet.Ethernet.IpV4.Payload.ToArray(); // ICMP packet
buffer[0] = 0; // Echo Reply
buffer[2] = 0; // checksum byte 1
buffer[3] = 0; // checksum byte 0
ushort checksum = ComputeIpChecksum(buffer);
buffer[2] = (byte)(checksum >> 8); // checksum byte 1
buffer[3] = (byte)(checksum & 0xff); // checksum byte 0

PayloadLayer payloadLayer =
new PayloadLayer
    Data = new Datagram(buffer),
After this, the ping worked properly, but it's still not that fast .. it's 40ms.
The reason why I'm worried about this, is because when my app will be fully developed, it will perform NAT between 2 network interfaces, at potentially high speeds.
Jan 7, 2014 at 9:46 AM
Looks like the NPF driver has a buffer with some sort of time out, because if I send larger ICMP packets they are captured instantly ..
Jan 7, 2014 at 6:39 PM
You can create any IcmpLayer you want without hand crafting it.
If you want to create an ICMP echo reply, just create an IcmpEchoReplyLayer.
You can take a look at all of the concrete subclasses of IcmpLayer to see what is supported.