Is there a way to send raw packet Ethernet to other host via C#? In Windows 7 if it makes difference.
-
2What do you expect to happen on the other end? Raw too? Making your own protocol? What's wrong with the ones we all use, your hardware knows how to route and your LAN admin knows how to support? – Hans Passant Oct 19 '10 at 00:38
-
I just want send ethernet packet with some changed fields like MAC address – Saint Oct 19 '10 at 09:57
-
2SharpPcap and Pcap.net are the way to go. You need a WinPcap wrapper framework because Windows doesn't allow access to lower level protocol headers for 'security reasons'. WinPcap provides its own networking driver that allows you to bypass that restriction. – Evan Plaice Nov 10 '10 at 08:44
3 Answers
Based on suggestion by Saint_pl:
I found probably better solution - similar to SharpPcap. It's Pcap.Net - .NET wrapper for WinPcap. Now I can modify my packets whatever I want.
I have some resources for you that maybe helpful. I don't try that solutions in Windows 7 but maybe it contains some good info to start.
Raw Ethernet Packet Manipulation or mirror on CodeProject
This purpose of this article is to explain how to send a raw Ethernet packet using C# on a Microsoft platform. A raw Ethernet packet is the complete Layer 2 network frame that is sent to the physical wire. Sending a frame like this allows you to manipulate the target and source MAC addresses and the Layer 3 protocol fields.
Also some info on raw sockets (just in case you interesting too):
Client (and Server) Sockets Communication take a look on whole chapter but here key parts:
- C# Raw UDP Socket Program Example
- C# Raw Socket Ping Program Example part A | part B
- All examples
Not sending packets but maybe interesting: A Network Sniffer in C#, SharpPcap - A Packet Capture Framework for .NET

- 930
- 11
- 26

- 4,231
- 2
- 20
- 24
-
I think Raw Ethernet Packet Sending from CodeProject will help me. And btw I suppose it's one and only way that I was found to send ethernet packet with e.g changed mac address via C#. – Saint Oct 19 '10 at 10:21
-
Raw ethernet manipulation is pretty low level. To complete your task at good level you certainly need some knowledge about Network Driver Interface Specification and understanding device drivers (and its API). Don't skip it. C# alone don't give you full power in that task. – Nick Martyshchenko Oct 19 '10 at 15:06
-
2I found probably better solution - similar to SharpPcap. It's http://pcapdotnet.codeplex.com/ - .NET wrapper for WinPcap. Now I can modify my packets whatever I want. Thanx :) – Saint Oct 23 '10 at 14:54
-
Welcome :) Glad to see that you have nice solution for your task. – Nick Martyshchenko Oct 23 '10 at 17:14
-
-
@Gobliins Pcap.Net is a .NET wrapper for WinPcap, so it's a managed interface to WinPCap and requires WinPcap installed to function properly. Here some details how to run it http://pcapdotnet.codeplex.com/wikipage?title=Using%20Pcap.Net%20in%20your%20programs&referringTitle=Pcap.Net%20User%20Guide – Nick Martyshchenko Oct 12 '12 at 17:02
-
-
@beppe9000 Pcap.Net's description says support for [Ethernet + VLAN tagging (802.1Q)](https://github.com/PcapDotNet/Pcap.Net) but I never tried myself – Nick Martyshchenko Nov 18 '16 at 20:38
-
Raw ethernet frames use a length (<= 1500) vs. an EtherType field, and the payload starts with `0xFFFF`. Today, we normally use Ethernet II with IP, rather than Novell. – Ron Maupin Apr 05 '22 at 18:32
iphelper API has some low level stuff - but probably not quite as low as you want to get

- 48,078
- 23
- 82
- 145
Socket server = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
IPEndPoint ip = new IPEndPoint(IPAddress.Parse("10.25.184.11"), 4456);
server.Connect(ip);
byte[] sendData = new byte[] { 0, 8, 32, 64 };
server.Send(sendData);
//done. now let's listen for data
byte[] receiveData = new byte[1024];
int receivedDataLength = server.Receive(receiveData);
//if the response is a string message
string stringData = Encoding.ASCII.GetString(receiveData, 0, receivedDataLength);
Console.WriteLine(stringData);

- 3,400
- 5
- 24
- 37
-
15This is a TCP packet, not an ethernet packet... You're 2 layers too high on the stack ;) – Thomas Levesque Oct 18 '10 at 23:04
-
3
-
Also this would not work on Windows 7. [Only Server versions of windows allow use of raw TCP sockets](http://msdn.microsoft.com/en-us/library/windows/desktop/ms740548%28v=vs.85%29.aspx#LIMITATIONS_ON_RAW_SOCKETS) due to malware abuse in the past. – Scott Chamberlain Jul 12 '13 at 23:39