Sniffed packets are wrong

Question

I want to sniff packets on my server and I just tried some wrappers for receive packets like MJSniffer, SharpCap but thats all show me wrong data

I had to write server - client exe for check received packets and im surprised. For example i sent to following packet

client_.Send(new byte[] { 0x01 , 0xC1 , 0x12 });

and following packets received by sniffer, and its often show different bytes.I tried to convert them to hex value's and same result

136, 184, 7, 50, 226, 41, 144, 15, 202, 11, 76, 178, 80, 16, 1, 0, 18, 142, 0, 0

what does it mean ? can i receive like 0x01 0xC1 0x12

Sniff code :

   public void OnReceive(IAsyncResult ar)
    {
        int nReceived = this._SocketCnn.EndReceive(ar);
        ParseData(byteData, nReceived);
        byteData = new byte[4096];
        this._SocketCnn.BeginReceive(byteData, 0, byteData.Length, SocketFlags.None,
            new AsyncCallback(OnReceive), null);
    }

    public void ParseData(byte[] byteData, int nReceived)
    {

        IPHeader ipHeader = new IPHeader(byteData, nReceived);
        if (ipHeader.ProtocolType == Protocol.TCP)
        {
            TCPHeader tcpHeader = new TCPHeader(ipHeader.Data, (int)ipHeader.MessageLength);
            if (Convert.ToInt32(tcpHeader.SourcePort) == this._ParamsCnn.Port)
            {
                TCPHeader tcpHeader_ = new TCPHeader(byteData, nReceived);
                ReturnData returnMsg_ = new ReturnData();
                returnMsg_.ReceivedData = ipHeader.Data;
                returnMsg_.SourceIPAddress = ipHeader.SourceAddress.ToString();
                returnMsg_.SourcePort = Convert.ToInt32(tcpHeader.SourcePort);
                returnMsg_.TargetIPAddress = ipHeader.DestinationAddress.ToString();
                returnMsg_.TargetPort = Convert.ToInt32(tcpHeader.DestinationPort);
                OnDataReceivedEvent(returnMsg_);
            }
        }
    }

Do you mean you expect your sniffer to deliver only TCP payloads, not raw packets? — Frédéric Hamidi, Jan 20 '15 at 20:10
i sent 0x01 , 0xC1 , 0x12 TCP packets but sniffer capture it as 136, 184, 7, 50, 226, 41,...... — Burak Dincer, Jan 20 '15 at 20:12
Yup, you said that already. Are you sure the sniffer is not dumping the raw IP packets? Can you post the parts of your code that performs the capture? — Frédéric Hamidi, Jan 20 '15 at 20:14
TCP has headers on it you need to account for. Sniffers like wireshark, you will need to look specifically at the data portion of the packet. — Will Eddins, Jan 20 '15 at 20:14

Sniffed packets are wrong

0 Answers0