使用PcapDotNet拆分数据包(碎片)

时间:2014-03-04 15:11:09

标签: c# .net packet pcap.net

我尝试使用PcapDotNet拆分数据包(碎片)并找到this

所以这是我的功能:

private IEnumerable<Packet> SplitPacket(Packet packet, int numberOfFragments)
{
    IpV4Datagram ipV4Datagram = packet.Ethernet.IpV4;

    if (ipV4Datagram.Protocol == IpV4Protocol.Tcp || ipV4Datagram.Protocol == IpV4Protocol.Udp)
    {
        EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
        ILayer layer = packet.Ethernet.IpV4.ExtractLayer();
        TcpLayer tcpLayer = (TcpLayer)packet.Ethernet.IpV4.Tcp.ExtractLayer();
        tcpLayer.Checksum = null;
        IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
        ipV4Layer.HeaderChecksum = null;
        DateTime packetTimestamp = packet.Timestamp;
        PayloadLayer payload = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer(); //extract the data
        int totalLength = payload.Length;
        int partialLength = totalLength / numberOfFragments; //split data into smaller segments
        partialLength = (partialLength / 8) * 8; //make sure it's divisible with 8
        //(http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly)
        ushort offset = 0; //send one by one

        while (offset < totalLength)
        {
            int fragmentLength = partialLength; //get length for this fragment
            IpV4FragmentationOptions options = IpV4FragmentationOptions.MoreFragments;

            if (offset + fragmentLength >= totalLength) //is this the last fragment ? trim length if needed
            {
                options = IpV4FragmentationOptions.None;
                fragmentLength = totalLength - offset;
            }

            byte[] newBuffer = ipV4Datagram.Payload.ToArray(); //copy the actual data into a new buffer
            PayloadLayer newPayload = new PayloadLayer { Data = new Datagram(newBuffer, offset, fragmentLength) };
            ipV4Layer.Fragmentation = new IpV4Fragmentation(options, offset); //change IP layer fragmentation options
            yield return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, tcpLayer, newPayload); //return
            offset += (ushort)fragmentLength; //next offset
        }
    }
}

问题是,在播放此文件后,我可以看到与原始Wireshark文件中相同数量的数据包,因此这意味着某些内容无效,Wiresahrk中的协议字段将此数据包识别为IPV4这就是这个数据包的样子(我想我已经以无效方式构建了这个数据包):

enter image description here

0 个答案:

没有答案