I have a CSV record as shown below.
"1","0.000000","2.1.1.2","2.1.1.1","IPv4","1010","Fragmented IP protocol (proto=ICMP 1, off=0, ID=b5d0) [Reassembled in #2]"
My requirement is to convert this single record into a pcap record as shown in below pic using .NET libraries.
Can anyone with expertise in this area help me how to achieve this, so that the resulting pcap file can be successfully opened and viewed in Wireshark?
That appears to be a CSV of the packet list columns from Wireshark/TShark.
What a pcap file contains is raw binary packet data corresponding to what was transmitted on the network. The packet list is a list of packet summaries; this means that some of the packet data does not generate any text in the summary, so it's impossible to regenerate packet data from the summary.
That packet is the first fragment from a fragmented IP packet with two fragments (that's what "Reassembled in #2" indicates), and, when it generated the CSV, Wireshark/TShark was configured to reassemble IP fragments, and didn't dissect the reassemble packet until the last fragment, and shows the other fragments as fragments. This means that almost all of the data - the entire payload of that fragment - is not shown in the summary, and is thus not available and is impossible to regenerate.
My recommendation is that you talk to the person who provided you with that CSV, and ask them for the capture file from which they generated the CSV.
