1

Note: My preference to solve this problem is to use UDPClient, but berkley Socket classes will work as well.

Question: I have been searching everywhere on how to read the "TTL" of incoming packets, but I can't find this anywhere. I know that 

Socket s = new Socket(ipe.AddressFamily, SocketType.Stream, ProtocolType.Tcp);
s.Ttl;

lets me get or set the Ttl for outgoing packets, but I want to read the ttl value on incoming packets. I'm having a tough time parsing anything outside of the data portion of incoming packets, but my goal is to do logic on and eventually record entire packets containing the UDP and IP header and all. What am I misunderstanding here?

Goku
  • 1,565
  • 1
  • 29
  • 62
  • It's possible with setsockopt / recvmsg, but I don't think it can be done directly in dotnet. https://stackoverflow.com/questions/16165542/is-it-possible-to-read-the-ttl-ip-header-field-when-receiving-udp-packets – Jeremy Lakeman Feb 03 '20 at 23:25

1 Answers1

1

TTL applies at the IP Layer. UDP does not have a TTL. By the time the packet payload is passed to the UDPClient (or even a UDP socket) the TTL information is gone and is unfortunately not retained in the Socket.

Neither a UDP or TCP socket can see this. You would need to use a RAW Socket which has the entire IP header included in the socket.Read() and then process the packet and extract the TTL.

Reading the TTL of TCP packets at the Socket layer with RAW sockets would be an impossible (extremely difficult) task as you would need to write your own TCP stack. If you wanted to "monitor" TCP TTL which could vary for parts of a message then you would be better to look at using WFP or PCAP.

Here is a good link on how to do RAW Socket UDP in c#

Rowan Smith
  • 1,815
  • 15
  • 29