Fix packet with wrong checksum with Pcap.Net

Question

I have several PCAP files with bad Checksum and in order to fix those files i am using this method:

private Packet FixBadChecksum(Packet packet)
        {
            try
            {
                EthernetLayer ethernet = (EthernetLayer)packet.Ethernet.ExtractLayer();
                IpV4Layer ipV4Layer = (IpV4Layer)packet.Ethernet.IpV4.ExtractLayer();
                DateTime packetTimestamp = packet.Timestamp;
                TransportLayer transportlayer = (TransportLayer)packet.Ethernet.IpV4.Transport.ExtractLayer();
                ILayer datagramLayer = (PayloadLayer)packet.Ethernet.IpV4.Payload.ExtractLayer();
                ipV4Layer.HeaderChecksum = null;

                if (transportlayer == null)
                    return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, datagramLayer);
                else
                {
                    transportlayer.Checksum = null;
                    ILayer payload = packet.Ethernet.IpV4.Transport.Payload.ExtractLayer();
                    return PacketBuilder.Build(packetTimestamp, ethernet, ipV4Layer, transportlayer, payload);
                }
            }
        catch (Exception)
        {
            return packet;
        }
    }

Now for example if my packet is ICMP after this packet (with bad checksum) finish my function it's still with bad Checksum, so my question is: i need to check every packet protocol or there is a generic method to do that ? (currently my function working fine with TCP and UDP but what about other protocols ?)

score 0 · Answer 1 · answered Feb 06 '15 at 12:50

Quoting a similar discussion in Pcap.Net site:

The bad checksums you see are the checksums of the IPv4 header or the TCP over IPv4 header inside the ICMP. These checksums are likely to be bad because the data over ICMP is only a partial copy of the packet that was sent to which the ICMP was returned.

Fix packet with wrong checksum with Pcap.Net

1 Answers1