我尝试使用PcapDotNet
拆分数据包(碎片)并找到this
所以这是我的功能:
private IEnumerable<Packet> SplitPacket(Packet packet, int numberOfFragments)
{
IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;
if (ipV4Datagram.Protocol == IpV4Protocol.Tcp || ipV4Datagram.Protocol == IpV4Protocol.Udp)
{
EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
ILayer layer = packet.Ethernet.IpV4.ExtractLayer();
TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
tcpLayer.Checksum = null;
IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
ipV4Layer.HeaderChecksum = null;
DateTime packetTimestamp = packet.Timestamp;
PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data
int totalLength = payload.Length;
int partialLength = totalLength / numberOfFragments; //split data into smaller segments
partialLength = (partialLength / 8) * 8; //make sure it's divisible with 8
//(http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly)
ushort offset = 0; //send one by one
while (offset < totalLength)
{
int fragmentLength = partialLength; //get length for this fragment
IpV4FragmentationOptions options = IpV4FragmentationOptions.MoreFragments;
if (offset + fragmentLength >= totalLength) //is this the last fragment ? trim length if needed
{
options = IpV4FragmentationOptions.None;
fragmentLength = totalLength - offset;
}
byte[] newBuffer = ipV4Datagram.Payload.ToArray(); //copy the actual data into a new buffer
PayloadLayer newPayload = new PayloadLayer { Data = new Datagram(newBuffer, offset, fragmentLength) };
ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset); //change IP layer fragmentation options
yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer, newPayload); //return
offset += (ushort)fragmentLength; //next offset
}
}
}
问题是,在播放此文件后,我可以看到与原始Wireshark
文件中相同数量的数据包,因此这意味着某些内容无效,Wiresahrk
中的协议字段将此数据包识别为IPV4
这就是这个数据包的样子(我想我已经以无效方式构建了这个数据包):