1

I am using Pcap.net to send packets using send buffer with Wireshark file (pcap extension) and my question is there is any way to change the packet's IP during or before playback? Here I fill the buffer with the packets from the file before the transmit: 

int numPackets = 0;
Packet packet;
while (inputCommunicator.ReceivePacket(out packet) == PacketCommunicatorReceiveResult.Ok)
{
    ILayer layer = packet.Ethernet.ExtractLayer(); --> new layer
    sendBuffer.Enqueue(packet);
    ++numPackets;
}
user979033
  • 5,430
  • 7
  • 32
  • 50
  • You'll need to manipulate the packets before they're queued up. I think the packet parsing library Pcap.NET uses is called Packet.NET. Take a look at what you can do with that. – M.Babcock Mar 28 '12 at 18:42
  • i update my code and create new layer but dont now how to continue – user979033 Mar 28 '12 at 19:00

1 Answers1

1

The answer is yes.

I believe the discussion in Pcap.Net forum would help you.

In general, you need to extract all the relevant layers (Ethernet, IPv4 and IPv4 payload), change the IPv4's layer IP and build the new packet.

If you want to make sure the IPv4 checksum would be correct, you need to set the IPv4 layer checksum field to null.

If you have TCP or UDP and you want to make sure their checksum is correct, you need to extract the relevant transport layer, change its checksum field to null and build the packet from the Ethernet, IPv4, Transport and Transport payload layers.

I hope this helps.

brickner
  • 6,595
  • 3
  • 41
  • 54