Nov 17, 2011 at 4:19 PM
Edited Nov 18, 2011 at 1:34 PM

If  I create a tcp packet with a big payload which have multiple http messages. For example a payload which have a .css, .png and jpg datas. Can i see each of them in httpcollection property? 

Another question: Is TcpDatagram.isValid() checks tcp checksum? If not how can i check the checksums of tcp packets with


Nov 19, 2011 at 9:21 AM

Hi varstas,


I think you can simply create multiple HttpLayers for that.

Note that it might be too big for one packet.


No, TcpDatagram.IsValid does not check TCP checksum.

That's because the TCP checksum is also based on the IPv4 parameters.

In order to check if the TCP checksum is correct, you can use IpV4Datagram.IsTransportChecksumCorrect.

IpV4Datagram.IsValid also checks the TCP checksum.


I hope this helps,



Nov 30, 2011 at 11:23 AM
Edited Nov 30, 2011 at 2:53 PM

I have a byte array full of payloads of tcp packets ordered according to their sequence numbers. I want  to create a packet and set its payload data to the byte array. So this way i can parse all http data of an entire session. How can i set the payload of a packet's tcp datagram?


Is there a way to create HttpLayer or HttpDatagram objects with byte arrays?


Btw I think httpCollection property is sometimes gives wrong amount of http.


Another question why i cant build your solution is it so hard to build it?

Nov 30, 2011 at 8:03 PM

Setting TCP payload:

Packet packet = PacketBuilder.Build(..., ethernetLayer, ipV4Layer, tcpLayer, tcpPayloadLayer);


If you use the code above, you can then use

packet.Ethernet.IpV4.Tcp.Http // To get HttpDatagram

packet.Ethernet.IpV4.Tcp.Http.ExtractLayer // To get HttpLayer


I don't think building the solution is hard, but you need to follow the instructions in Pcap.Net Developer Guide.


I hope this helps,



Dec 1, 2011 at 6:26 AM
Edited Dec 2, 2011 at 11:10 AM

I couldnt find tcpPayloadLayer.

I tried to create a packet with 


Datagram serverDatagram = new Datagram(nTcpSession.ServerToClientStream.ReConstructedBytes); // reconstructedbytes = 78297 bytes

Packet packet = PacketBuilder.Build(new ethernetLayer{}, new ipV4Layer{}, new tcpLayer{}, new PayloadLayer{ Data = serverDatagram} );


Looks like the problem caused by Ipv4Datagram creation. In my case Ethernet Payload Length is 78337 but Ipv4 Payload Length is 12781 so im only seeing 2 http datagrams. Is there a limitation in Ipv4Datagram?

But this way i think im setting the payload of whole packet not just the tcpPayload.

All i want is just set the tcp layer's payload to my reconstructed bytes. I want to use Http Parser to parse my reconstructed bytes.

So much ty for trying to help me Boaz. 

Dec 2, 2011 at 6:11 PM

An IP Layer + all its payloads (TCP and TCP's payload) cannot exceed 65535 bytes.

Dec 3, 2011 at 7:14 AM

Where is it written in your code?

Dec 3, 2011 at 8:30 AM

I'm not sure that it does.

I will consider adding an exception for that case.

It is just part of the IPv4 protocol:

Dec 3, 2011 at 10:23 AM

Ok thank you so much brickner. Looks like i couldnt parse the whole stream with this method. I should change my design and parse http messages one by one. Again thank you Brickner.