Change packet ip using Pcap.Net without know in advance if the packet is TCP, UDP

Nov 20, 2014 at 7:42 AM
Edited Nov 20, 2014 at 10:13 AM
In my application I am using Pcap.net DLLs and change packet ip in this way:
private Packet ChangePacketIp(Packet packet, string oldIpAddress, string newIpAddress)
{
    try
    {
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                DateTime packetTimestamp = packet.Timestamp;
                ILayer transportlayer = packet.Ethernet.IpV4.Transport.ExtractLayer();  
                ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
                

                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipV4Layer.Source = new IpV4Address(newIpAddress);
                    ipV4Layer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipV4Layer.CurrentDestination = new IpV4Address(newIpAddress);
                    ipV4Layer.HeaderChecksum = null;
                }

                return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, transportlayer, payload);
    }
    catch (Exception)
    {
        return null;
    }
}
This function change my packet ip address but the TCP\UDP layer is with bad checksum and i cannot see how to fix it
Coordinator
Nov 22, 2014 at 10:10 AM
Hi gshhar,

You should probably the payload extraction line to
ILayer payload = packet.Ethernet.IpV4.Transport.Payload.ExtractLayer();
I hope this helps,

Boaz.
Nov 23, 2014 at 8:22 AM
Still bad checksum
Coordinator
Nov 28, 2014 at 9:14 AM
Hi gshhar,

Can you provide the new code that causes a bad checksum?

Boaz.
Nov 29, 2014 at 9:50 AM
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                DateTime packetTimestamp = packet.Timestamp;
                ILayer transportlayer = packet.Ethernet.IpV4.Transport.ExtractLayer();
                ILayer payload = packet.Ethernet.IpV4.Transport.Payload.ExtractLayer();
                
                if (packet.Ethernet.IpV4.Source.ToString() == oldIpAddress)
                {
                    ipV4Layer.Source = new IpV4Address(newIpAddress);
                    ipV4Layer.HeaderChecksum = null;
                }
                else if (packet.Ethernet.IpV4.Destination.ToString() == oldIpAddress)
                {
                    ipV4Layer.CurrentDestination = new IpV4Address(newIpAddress);
                    ipV4Layer.HeaderChecksum = null;
                }

                return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, transportlayer, payload);
Coordinator
Nov 30, 2014 at 2:56 PM
You should probably also do
transportLayer.Checksum = null
I hope this helps,

Boaz.
Nov 30, 2014 at 3:22 PM
Edited Nov 30, 2014 at 3:29 PM
transportLayer not contain this property (Checksum is missing)

Please see this: http://s30.postimg.org/xevkfhahd/21231.png

I am using the last DLL version.
Coordinator
Nov 30, 2014 at 3:34 PM
You should cast transportLayer to TransportLayer.
Nov 30, 2014 at 3:53 PM
Thanks that working now !
BTW in case my packet is ICMP what should i do in order to change the IP address ?
in this case my transport layer is null.
Coordinator
Dec 12, 2014 at 12:34 PM
For ICMP this is very similar, you need to use IpV4Datagram.Icmp instead of IpV4Datagram.Tcp.