This project is read-only.

What is the best way to build new packet when i want to fix packet checksum

Sep 18, 2012 at 1:19 PM
Edited Sep 18, 2012 at 1:20 PM

Hi,

i am using pcapdotnet DLL's in order to transmit packet to my network card (Wireshark pcap files).

some of the packets has bad checksum and i know how to build new packet after extract all the layers and rebuild the packet (and configure Checksum to null in order to recalculate) but my question is how do i now what kind on packet should i expect ? TCP or UDP or none of them ?

i should i handle this ?

if you can show me a shork code example i will be glad.

 

Thanks !

Sep 28, 2012 at 1:28 PM

I don't understand, why do you need to expect a packet kind?

What kind of checksum do you want to recalculate, IP or TCP/UDP?

 

If you want TCP/UDP, you can use the Transport property of IpV4Datagram to get a generic Transport datagram and extract the layer from it.

This way you don't have to know in advance if it's TCP or UDP.

You can also check the IP Protocol to make sure.

 

I hope this helps,

 

Boaz.

Oct 2, 2012 at 11:51 AM
Edited Oct 4, 2012 at 7:16 PM

 

this is the way how to do it  or i missing something ?

        public static Packet buildNewPacket(Packet packet)
        {
            Packet newPacket = null;
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            IpV4Layer ipLayer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            ipLayer.HeaderChecksum = null;
            IpV4Datagram ipDatagram = packet.Ethernet.IpV4;
            ILayer layer = ipDatagram.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, layer, payload);

            return newPacket;


Oct 5, 2012 at 11:57 AM

Almost.

You should use ipLayer instead of layer when building the packet, since you didn't change layer's HeaderChecksum property, only ipLayer's HeaderChecksum.

 

I assume you only want to recalculate the IP header checksum and not the TCP/UDP checksum.

Oct 5, 2012 at 1:33 PM
Edited Oct 5, 2012 at 1:35 PM

assume i want to change the packet IP this will work ?

        public static Packet changePacketIp(Packet packet, IpV4Address oldIpAddress, IpV4Address newIpAddress)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
            ILayer layer = ipV4Datagram.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            Packet newPacket = null;

            if (packet.Ethernet.IpV4.Source == oldIpAddress)
            {
                ipV4Layer.Source = newIpAddress;
                ipV4Layer.HeaderChecksum = null;
            }
            else if (packet.Ethernet.IpV4.Destination == oldIpAddress)
            {
                ipV4Layer.CurrentDestination = newIpAddress;
                ipV4Layer.HeaderChecksum = null;
            }

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);

            return newPacket;
        }

and if i only wants to fix packets bad checksum:

        public static Packet fixBadChecksum(Packet packet)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
            ILayer layer = ipV4Datagram.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            ipV4Layer.HeaderChecksum = null;
            Packet newPacket = null;

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);

            return newPacket;
        }

Oct 7, 2012 at 2:19 PM
psptst1 wrote:

assume i want to change the packet IP this will work ?

        public static Packet changePacketIp(Packet packet, IpV4Address oldIpAddress, IpV4Address newIpAddress)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
            ILayer layer = ipV4Datagram.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            Packet newPacket = null;

            if (packet.Ethernet.IpV4.Source == oldIpAddress)
            {
                ipV4Layer.Source = newIpAddress;
                ipV4Layer.HeaderChecksum = null;
            }
            else if (packet.Ethernet.IpV4.Destination == oldIpAddress)
            {
                ipV4Layer.CurrentDestination = newIpAddress;
                ipV4Layer.HeaderChecksum = null;
            }

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);

            return newPacket;
        }

and if i only wants to fix packets bad checksum:

 

        public static Packet fixBadChecksum(Packet packet)
        {
            EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
            IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
            IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
            ILayer layer = ipV4Datagram.ExtractLayer();
            DateTime packetTimestamp = packet.Timestamp;
            ILayer payload = packet.Ethernet.IpV4.Payload.ExtractLayer();
            ipV4Layer.HeaderChecksum = null;
            Packet newPacket = null;

            newPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, payload);

            return newPacket;
        }

 

You still don't use the 'layer' variable so I don't understand why you define 'ipV4Datagram' and 'layer'.

When you change the source or destination of the IP layer, the TCP and UDP checksum are affected so you also need to clear these checksum to recalculate them.

 

The best way to know if this would work is to try.

Save the packets to a pcap file and open it in Wireshark to see if this is what you need.

Oct 7, 2012 at 3:57 PM

i am checking my output with Wireshark all the time and compare it to the original Wireshark file.

so which layer should i ignore and not using ipV4Datagrm or Layer ?

my application crash when received ipV6 packet, what is your recommendation in case i have ipV6 packet ?

Oct 12, 2012 at 8:01 AM

You define two variables you don't use.

The first variable is called 'layer'.

The second variable is called 'ipV4Datagram'.

You just define and set them, you don't use them.

 

Regarding IPv6, it is currently not supported in Pcap.Net.

You can either drop any IPv6 packet or parse the Ethernet Payload yourself until IPv6 will be supported.

Oct 12, 2012 at 1:27 PM

should i use them ?

Oct 13, 2012 at 9:52 AM

With your current code no.

Oct 13, 2012 at 12:03 PM

Thanks a lot !