PcapDotNet Issue Tracker Rss Feed

Created Unassigned: When a IpV4 packet is fragmented, sometimes it returns a zero length IpV4Datagram. [10129]

sumtec — Wed, 22 May 2013 06:46:01 GMT

According to https://en.wikipedia.org/wiki/IPv4, when a ipv4 packet is fragmented, the total length should be the length of the current segment. However, in the real world, I found that the total length could be zero when there are payload and the ip4v packet is marked "More Fragmentations". In this case, the code now will return no data inside ipv4 packet, i.e. no TCP packet, which is not correct.

Created Unassigned: IpV4FragmentationOptions have wrong values [10128]

sumtec — Wed, 22 May 2013 05:15:44 GMT

According to http://en.wikipedia.org/wiki/IPv4 the Option Value in the high 3 bits of the byte value in offset 6 should have:
0 Reserved
1 Don't Fragment
2 More Fragments

However, right now the code looks like this:
/// <summary>
/// May Fragment, Last Fragment.
/// </summary>
None = 0x0 << 13,

/// <summary>
/// More Fragments.
/// </summary>
MoreFragments = 0x1 << 13, // <-------- this should be DoNotFragment

/// <summary>
/// Don't Fragment.
/// </summary>
DoNotFragment = 0x2 << 13 // <-------- this should be MoreFragments

They are just transposed.

Closed Issue: Support for Linux SLL datalink [9685]

Brickner — Thu, 16 May 2013 11:45:15 GMT

I have captured a pcap file using Tao tPacketCapture on Android (http://www.taosoftware.co.jp/en/android/packetcapture/). The problem is that the pcap file I captured has a datalink of "LINUX_SLL (Linux cooked)" and this throws an exception 'packet.IsValid' threw an exception of type 'System.NotSupportedException'base {System.SystemException} = {"PcapDataLink 113 - LINUX_SLL (Linux cooked) is unsupported"}I've attached the pcap file in question.

Commented Issue: Visual Studio crashes at program exits [10010]

Brickner — Tue, 16 Apr 2013 07:10:58 GMT

Hi,
when I run my program which uses Pcap.Net, when the program is going to exit it crashes with the error "vshost32.exe has stopped working". I used other third party libraries (even from codeplex) and this didn't happen with them, which is why I'm suspecting Pcap.Net. Although human error (from my side) is still probably the problem. So if someone can show me what setting or whatever I need to do, it would be very much appreciated.
Comments: ** Comment from web user: Brickner **

Can you give some details on how to reproduce this?

Created Issue: Visual Studio crashes at program exits [10010]

Twoeyes — Sun, 07 Apr 2013 17:15:54 GMT

Hi,
when I run my program which uses Pcap.Net, when the program is going to exit it crashes. I used other third party libraries (even from codeplex) and this didn't happen with them, which is why I'm suspecting Pcap.Net. Although human error (from my side) is still probably the problem. So if someone can show me what setting or whatever I need to do, it would be very much appreciated.

Commented Issue: Support for Linux SLL datalink [9685]

Brickner — Fri, 23 Nov 2012 20:27:24 GMT

I have captured a pcap file using Tao tPacketCapture on Android (http://www.taosoftware.co.jp/en/android/packetcapture/). The problem is that the pcap file I captured has a datalink of "LINUX_SLL (Linux cooked)" and this throws an exception

'packet.IsValid' threw an exception of type 'System.NotSupportedException'
base {System.SystemException} = {"PcapDataLink 113 - LINUX_SLL (Linux cooked) is unsupported"}

I've attached the pcap file in question.
Comments: ** Comment from web user: Brickner **

Just committed changeset 71055, which adds support for Linux SLL datalink.
This would be supported in the next version of Pcap.Net or in any version you download the source for and build yourself starting from changeset 71055.

Commented Issue: Create ability to block packets from being passed on to windows driver [9686]

Brickner — Fri, 23 Nov 2012 19:48:18 GMT

I'm trying to use Pcap.Net to bypass winsockets altogether and to send packets directly. I must do this, because RAW sockets are supported only on the server class windows operating systems. I want to do this, because Pcap.Net is much better suited for low level network interactions than raw sockets (better structure, ability to access Ethernet layer ect).

My problem is that, as it is, the packets that are received are passed on to windows driver, which creates bad interactions.

Consider flowing: I'm trying to open a tcp connection to the host. I send the SYN package and it sends me back SYN-ACK package. Before I can confirm the connection for open, Windows driver, which processes the SYN-ACK package sends RST package to close the connection. At present, there's nothing I can do about this issue.
Comments: ** Comment from web user: Brickner **

You should use a system / drivers / devices that aren't interfering with the packets you don't want them to interfere.
Pcap.Net is a WinPcap wrapper and WinPcap doesn't block packets.
I'll close this issue, since it's out of the scope of Pcap.Net and isn't planned to be supported in a future version, unless you want to change the feature request.

Created Issue: Create ability to block packets from being passed on to windows driver [9686]

menkaur — Wed, 24 Oct 2012 03:11:25 GMT

Created Issue: Support for Linux SLL datalink [9685]

brianestey17 — Tue, 23 Oct 2012 05:30:11 GMT

I have captured a pcap file using Tao tPacketCapture on Android (http://www.taosoftware.co.jp/en/android/packetcapture/). The problem is that the pcap file I captured has a datalink of "LINUX_SLL (Linux cooked)" and this throws an exception

'packet.IsValid' threw an exception of type 'System.NotSupportedException'
base {System.SystemException} = {"PcapDataLink 113 - LINUX_SLL (Linux cooked) is unsupported"}

I've attached the pcap file in question.

Closed Issue: Unit test failures: PcapDotNet.Core.Test, PcapDotNet.Packets.Test [8067]

Brickner — Fri, 27 Apr 2012 10:45:23 GMT

PcapDotNet.Core.Test.LivePacketDeviceTests.OpenLiveDevice
* Assumed a max of two addresses for an interface

PcapDotNet.Core.Test.WiresharkCompareTests.CompareArp
* The arp hardware type and operation are coming through as hex in the show values from tshark, not decimal as expected
* There's a wireshark bug which messes up the show values for AddressPrespecified timestamps. They come out with an additional timestamp value instead of an address/value pair.

PcapDotNet.Packets.Dns.DnsLayer.DnsLayer
* The Records field query needs non-null concatables
Comments:

Released in version 0.10.0.

Closed Issue: HTTP parsing error? [8444]

Brickner — Fri, 27 Apr 2012 10:45:09 GMT

Internet Explorer sends raw UTF-8 encoded bytes for everything after the "?" in an HTTP request URI. If the following HTTP request crosses pcap.net:

GET /%E2%84%AB/?Å#Å HTTP1/0
Host: example.com
User-Agent: Firefox

I get a null set of Headers returned from the packet.Ethernet.IpV4.Tcp.Http.Header collection. I also get a truncated URI:

(((PcapDotNet.Packets.Http.HttpRequestDatagram)(packet.Ethernet.IpV4.Tcp.Http))).Uri "/%E2%84%AB/?" string

Is there an internal problem parsing this? I know this is not legal HTTP, I'm doing it on purpose, but I thought pcap.net would be a little more liberal in what it accepted.
Comments:

Released in version 0.10.0.

Closed Issue: Support for VLan tagged frames over Ethernet [8496]

Brickner — Fri, 27 Apr 2012 10:44:37 GMT

It would be great if we could have vlan tagging support when constructing with packet builder. vlan tag is just another 4 bytes After the source Mac address before Ethernet type (nothing else).
Those 4 bytes are
xxx. .... .... .... = Priority:
...1 .... .... .... = CFI
.... xxxx xxxx xxxx = VLANID
(see http://en.wikipedia.org/wiki/IEEE_802.1Q) frame format.
Comments:

Released in version 0.10.0.

Closed Issue: HttpResponseLayer.Body is incomplete after ExtractLayer [7907]

Brickner — Fri, 27 Apr 2012 10:32:32 GMT

I use HttpResponseLayer to trace HTTP sessions from a WebBrowser, and I need to use the Body in my application (HttpResponseLayer.Body) but I noticed that if the http response is too large it is still limited to approximately 1200 bytes, therefore incomplete!

My code at last post : http://pcapdotnet.codeplex.com/discussions/245743
Comments:

Not reproducible.
The user probably requires TCP reconstruction.

Commented Issue: Ability to retrieve the package from nuget [9277]

Brickner — Wed, 11 Apr 2012 09:37:51 GMT

Ability to retrieve the package from nuget.

http://docs.nuget.org/docs/creating-packages/creating-and-publishing-a-package
Comments: ** Comment from web user: Brickner **

Can you give some details on why this is useful?

Created Issue: Support Link-Local Multicast Name Resolution (LLMNR) [9295]

Brickner — Sat, 07 Apr 2012 15:03:17 GMT

RFC 4795

Closed Issue: Add support for Riverbed TCP options [9289]

Brickner — Fri, 06 Apr 2012 12:03:06 GMT

Details are here:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5459
Comments:

Duplicated.

Created Issue: Add support for Riverbed TCP options [9289]

Brickner — Fri, 06 Apr 2012 11:57:57 GMT

Details are here:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5459

Created Issue: Add support for Riverbed TCP options [9288]

Brickner — Fri, 06 Apr 2012 11:55:02 GMT

Details are here:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5459

Created Issue: Ability to retrieve the package from nuget [9277]

youngcm2 — Mon, 02 Apr 2012 21:15:51 GMT

Ability to retrieve the package from nuget.

http://docs.nuget.org/docs/creating-packages/creating-and-publishing-a-package

Commented Issue: Please add Vlan tag support to the EthernetLayer [8496]

Brickner — Sun, 01 Apr 2012 19:15:06 GMT

I assume a valid example would be http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=vlan.cap.gz