reconstruct a pcap file

Apr 17, 2015 at 9:58 AM
Edited Apr 17, 2015 at 10:01 AM
Hi everybody
i have a program in c# that read a pcap file and do some changes in packet header fields(call anonymization) when i want to build a new pcap file after changes. i have 2 problem. 1) some data lose(my output file is 5-6 kb smaller than first file) and 2) in some pcap files(not all of them) i have error. i construct packets in this way. please tell me what is my wrong?? this is a part of my code for packet construction.
i think i forget some conditions in construct my packets.
// Print the packet


if (packet.Ethernet.IpV4.Protocol == IpV4Protocol.Tcp)
{
    PayloadLayer Payload = null;
    if ((packet.Ethernet.IpV4.Tcp.Payload != null) && (packet.Ethernet.IpV4.Tcp.Payload.Length >= 0))
    {
        Payload = (PayloadLayer)packet.Ethernet.IpV4.Tcp.Payload.ExtractLayer(); //extract the data                                 
        *tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer, Payload);*
    }
    else
    {
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer);
    }

}
else if (packet.Ethernet.IpV4.Protocol == IpV4Protocol.Udp)
{
    PayloadLayer Payload = null;
    if ((packet.Ethernet.IpV4.Udp.Payload != null) && (packet.Ethernet.IpV4.Udp.Payload.Length >= 0))
    {
        Payload = (PayloadLayer)packet.Ethernet.IpV4.Udp.Payload.ExtractLayer(); //extract the data                                             
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, udpLayer, Payload);
    }
    else
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, udpLayer);
}
else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV4.IsValid == true))
// else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV4!=null))
{
    PayloadLayer Payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data                                 

    if (Payload != null)
        //  tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, Payload);
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, Payload);
}
else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV6.IsValid == true))
//  else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV6 != null))
{
     IpV6Layer ipV6Layer = (IpV6Layer)packet.Ethernet.IpV6.ExtractLayer();

     PayloadLayer Payload = (PayloadLayer)packet.Ethernet.IpV6.Payload.ExtractLayer(); //extract the data                                 
     if (Payload != null)
         tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, ipV6Layer, Payload);
}
else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV4.IsValid == false) && (packet.Ethernet.IpV6.IsValid == false))
// else if ((packet.Ethernet.IpV4.Protocol != IpV4Protocol.Tcp) && (packet.Ethernet.IpV4.Protocol != IpV4Protocol.Udp) && (packet.Ethernet.IpV4==null) && (packet.Ethernet.IpV6==null))
{
    PayloadLayer Payload = (PayloadLayer)packet.Ethernet.Payload.ExtractLayer(); //extract the data                                 
    if (Payload != null)
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, Payload);
    else
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet);
}
else
{
    PayloadLayer Payload = (PayloadLayer)packet.Ethernet.Payload.ExtractLayer(); //extract the data                                 
    if (Payload != null)
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet, Payload);
    else
        tmpPacket = PacketBuilder.Build(packetTimestamp, ethernet);
}

PacketDumpFile.Dump(textBox2.Text, DataLinkKind.Ethernet, PacketDevice.DefaultSnapshotLength, packetList);
this is my error in some files.error is for * line:
"object reference not set to an instance of an object"
what is my wrong?
with which condition i can construct correct pcap file with anonymized data?

please help me.
thanks
Coordinator
Apr 18, 2015 at 11:04 AM
Hi fatima2007,

Please note that Pcap.Net has moved to GitHub.
See http://pcapdot.net

For Q&A, see Pcap.Net Q&A Group.