THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

"Time To Live" always 0 when creating custom pcap file programmatically

I'm building custom pcap files to meet business requirements for different pcap files using data streaming from a raw socket. These are UDP packets with a IPV 4 header. I'm creating a prototype of this custom pcap file manually to verify before automating it. When creating the IP header, an additional byte is inserted into the location of the TTL location resulting in the TTL value displaying the warning: ""Time To Live" only 0" rather than the value 128 that should be displayed. "128" is displayed at the protocol location. Using .Net binaryWriter and following the order of the IP header protocol, I'm writing the following values in this order:

ushort usTotalLength = (ushort)IPAddress.HostToNetworkOrder(68);
           //Sixteen bits for total length of the datagram (header + message)
ushort usIdentification = (ushort)IPAddress.HostToNetworkOrder(27715);
           //Sixteen bits for identification
ushort usFlagsAndOffset = (ushort)0;
           //Sixteen bits for flags and offset
byte byTTL = 128 
           //Eight bits for TTL (Time To Live)

I can't upload the pcap file (don't have enough points), but it is showing a "00" byte at the TTL location where byte "80" with value of 128 should be displayed. "80" is displayed at the next byte where protocol should be.

How is the additional byte getting added and how can I prevent it? I suspect it has something to do with the flags and offset this appear as 16 bits in wireshark.

Lawrence Karasek's avatar
1
Lawrence Karasek
asked 2023-02-17 19:52:36 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2023-02-18 03:20:41 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Decouple this from being a Wireshark issue. Have you looked at the contents of the file with a hex or binary editor?

Chuckc's avatar Chuckc (2023-02-18 00:32:55 +0000) edit
add a comment see more comments

1 Answer

0

Sounds like your code does not exactly do what you tell it to do. I can think of a byte ordering issue or maybe the BinaryWriter is created with some form of 16 bit encoding. This is more a .Net question, so you might have better luck asking in a .Net Q&A site

SYN-bit's avatar
18.5k
SYN-bit
answered 2023-02-18 13:05:12 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer