Send Raw IP packet in C#, everything above the ethernet layer

Question

I don't want to modify the ethernet portions of the frame, but I need to modify the IP packet and the data portion of the frame.

I try sending a raw frame and it still puts in the IP information. I basically need to send a frame without defining the endpoint except in the bits I'm sending.

Here's what I got:

Socket s = new Socket(AddressFamily.Unspecified, SocketType.Raw, ProtocolType.Raw);
EndPoint ep = new IPEndPoint(IPAddress.Parse("205.188.100.58"),80);
s.SendTo(GetBytes(""),ep); //im sending nothing, so i expect the frame to just have ethernet stuff
s.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, false);

My question: Using SendTo adds the IP portion of the frame, I don't want that as I want to spoof the source IP. Using "Send" will crash because it says I need to specify an endpoint. Any suggestions on what to do? I just want to send a packet and define the IP section and data section myself.

Note: No I'm not making a DOS attack, I need this for a legitimate use!

I know how to define the IP portion, its just a matter of actually sending the data without a generated IP portion.

possible duplicate of [How send raw ethernet packet with C#?](http://stackoverflow.com/questions/3964013/how-send-raw-ethernet-packet-with-c) — mafu, Apr 13 '11 at 16:25
This question got a much preferable text, but the answers are over there - this should be merged. — mafu, Apr 13 '11 at 16:25

score 9 · Accepted Answer · edited May 23 '17 at 12:19

9

Your question is very well answered here: How send raw ethernet packet with C#?

Using Pcap.Net sort of a library, you can easily modify individual data packets in any way you want (as it uses the underlaying WinPcap implementation which is very powerful).

You can also completely skip the IP layer and send to MAC addresses as in: http://www.codeproject.com/KB/IP/sendrawpacket.aspx where I used a similar approach to communicate with a micro-controller (Atmel ATmega) over Ethernet which provides almost realtime communications.

edited May 23 '17 at 12:19

Community

1
1

answered Apr 13 '11 at 16:15

Teoman Soygul

25,584
6
69
80

I saw that earlier, I was really hoping I could just do it straight in System.Net.Socket. Blah oh well – brandon Apr 13 '11 at 16:22
1

System.Net.Socket is a wrapper around Winsock so you can P/Invoke and use Winsock directly but using Pcap.Net will be much better. – Teoman Soygul Apr 13 '11 at 16:23
ya just realized that. Good find. thanks for the clarification – brandon Apr 13 '11 at 16:24

score 1 · Answer 2 · answered Jun 16 '17 at 16:05

"Using Pcap.Net sort of a library, you can easily modify individual data packets in any way you want (as it uses the underlaying WinPcap implementation which is very powerful)."

Wrong! WinPcap cant do filtering/packet dropping/ create packet. By other words, its just lets you monitor the packet in an async fashion...

Raw packet /Promiscuous mode/ Driver filter / packet routing is another talk.

Send Raw IP packet in C#, everything above the ethernet layer

2 Answers2

Linked