C# 使用Pcap.Net修复校验和错误的数据包
我有几个PCAP文件的校验和不正确,为了修复这些文件,我使用以下方法:C# 使用Pcap.Net修复校验和错误的数据包,c#,packet,pcap,pcap.net,C#,Packet,Pcap,Pcap.net,我有几个PCAP文件的校验和不正确,为了修复这些文件,我使用以下方法: private Packet FixBadChecksum(Packet packet) { try { EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer(); IpV4Layer ipV4Layer = (Ip
private Packet FixBadChecksum(Packet packet)
{
try
{
EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
DateTime packetTimestamp = packet.Timestamp;
TransportLayer transportlayer = (TransportLayer)packet.Ethernet.IpV4.Transport.ExtractLayer();
ILayer datagramLayer = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer();
ipV4Layer.HeaderChecksum = null;
if (transportlayer == null)
return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, datagramLayer);
else
{
transportlayer.Checksum = null;
ILayer payload = packet.Ethernet.IpV4.Transport.Payload.ExtractLayer();
return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, transportlayer, payload);
}
}
catch (Exception)
{
return packet;
}
}
现在举例来说,如果我的数据包是ICMP,在这个校验和错误的数据包完成我的函数后,它仍然是校验和错误的,那么我的问题是:我需要检查每个数据包协议,或者有一个通用的方法来做这件事?目前我的功能在TCP和UDP上运行良好,但其他协议如何?引用:
您看到的错误校验和是IPv4标头或
ICMP内的TCP over IPv4标头。这些校验和很可能
可能是错误的,因为ICMP上的数据只是数据包的部分副本
已发送并返回ICMP的