How to check if my PCAP file contain Bad CheckSum using PcapDotNet

Jan 1, 2015 at 7:58 PM
Is it possible to check if my PCAP file contain Bad CheckSum using PcapDotNet ? Of course i want to check IP, TCP and UDP layers. Currently i only can check if the packet is valid (the packet valid unless an invalid part was found: bad checksum, illegal field value, packet too short...) Also i can get the Checksum value (ushort value):
Packet packet;
ushort ipChecksum = packet.Ethernet.IpV4.HeaderChecksum;
ushort tcpChecksum = packet.Ethernet.IpV4.Tcp.Checksum;
ushort udpChecksum = packet.Ethernet.IpV4.Udp.Checksum;
is it possible to verify it's valid value ? (i know isValid propert do that but because of i am handle big packet length - up to 9000kb this property will be false although if the checksum is correct)
Coordinator
Jan 9, 2015 at 5:44 PM
Hi gshhar,

IpV4Datagram has IsHeaderChecksumCorrect property.
IpDatagram (base class for IpV4Datagram and IpV6Datagram) has IsTransportChecksumCorrect, which checks either UDP or TCP checksums.

I hope this helps,

Boaz.
Jan 10, 2015 at 6:50 AM
Edited Jan 10, 2015 at 3:03 PM
I have PCAP file with several packet with Bad Checksum (ip, tcp and udp).

I check the IP checksum this way:
IpV4Datagram ip = packet.Ethernet.IpV4;
 if (!ip.IsHeaderChecksumCorrect)
{
     //  
}
if i check tcp or udp check sum this way:
if (!ip.IsTransportChecksumCorrect)
{
     //
}
the value is always true although i have several packets with bad tcp or udp checksum.
is this the correct way to do that ?
Coordinator
Jan 10, 2015 at 8:20 PM
So you read a file with bad checksums (according to Wireshark) and Pcap.Net tells you the packets' checksums are ok?
If that's the case, please provide an example pcap file so I can take a look.
Jan 11, 2015 at 6:37 AM
Edited Jan 11, 2015 at 6:51 AM
My file contains 106 packet with bad IP header check sum (ip.checksum_bad == 1) - your code show 161
111 packets wih bad TCP checksum (tcp.checksum_bad == 1) - in the last provided code example your code didn't find any packets
and 1 packets wih bad UDP checksum (udp.checksum_bad == 1) - in the last provided code example your code didn't find any packets

http://s000.tinyupload.com/?file_id=98919279871619083612

http://www.filedropper.com/tst_1
Coordinator
Jan 16, 2015 at 11:53 AM
I see a lot of the packets in the pcap file are IPv6 packets.
If you run your code that assumes they are IPv4 packets, it is very likely you will find them as bad IP checksum.
Jan 17, 2015 at 12:50 PM
Edited Jan 17, 2015 at 12:50 PM
OK i removed all IPv6 packets from my file, Please see this code:
        private void BadCheckSumExist(string file)
        {
            int ipHeaderChecksum = 0;
            int tcpUdpCheckSumExist = 0;
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(new FileInfo(file).FullName);
            Packet packet;
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
            {
                while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
                {
                    if (packet != null)
                    {
                        IpV4Datagram ip = packet.Ethernet.IpV4;
                        if (!ip.IsHeaderChecksumCorrect)
                        {
                            ipHeaderChecksum++;
                        }
                        if (!ip.IsTransportChecksumCorrect)
                        {
                            tcpUdpCheckSumExist++;
                        }
                    }
                }
            }
        }
This code crash in line if (!ip.IsTransportChecksumCorrect):

An unhandled exception of type 'System.NullReferenceException' occurred in PcapDotNet.Packets.dll
Additional information: Object reference not set to an instance of an object.

Stack trace:

at PcapDotNet.Packets.Ip.IpDatagram.get_IsTransportChecksumCorrect() in C:\TFS\tfs.codeplex.com\TFS06\PcapDotNet\PcapDotNet\src\PcapDotNet.Packets\Ip\IpDatagram.cs:line 65
at PacketPlayer.forms.MainForm.BadCheckSumExist(String file) in d:\DropboxSvnClient\trunk\projects\PacketPlayer\PacketPlayer\forms\MainForm.cs:line 2511
at PacketPlayer.forms.MainForm..ctor() in d:\DropboxSvnClient\trunk\projects\PacketPlayer\PacketPlayer\forms\MainForm.cs:line 54
at PacketPlayer.Program.Main() in d:\DropboxSvnClient\trunk\projects\PacketPlayer\PacketPlayer\Program.cs:line 19
at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()
Coordinator
Jan 17, 2015 at 6:16 PM
You assume the packet is IPv4 over Ethernet.
You should probably verify first that it is.

Use packet.Ethernet.EtherType and make sure it is EthernetType.IpV4 before calling the IpV4 property.