Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CaptureFileWriterDevice.Write((RawCapture p) writes incorrect LinkLayerType if its not known to PacketDotNet #174

Open
twa89 opened this issue Dec 5, 2020 · 7 comments
Open

CaptureFileWriterDevice.Write((RawCapture p) writes incorrect LinkLayerType if its not known to PacketDotNet #174

twa89 opened this issue Dec 5, 2020 · 7 comments

Comments

@twa89
Copy link

twa89 commented Dec 5, 2020

I am opening a wireshark capture of a BACnet MSTP cap file, then trying to write the packet back out using CaptureFileWriterDevice.Write() method. When it writes the packet out, it does not preserve the link layer byte that was in the original packet that was read in.

BACnet MSTP is link layer 165, I see this byte in the source file, but in the one written out is was replaced with 0.

I looked at PacketDotNet and it seems to have an enum for link layer that doesn't have this value (165). I would think if a packet is read in, it could be written back as read. Here is a sample file with just 1 mstp packet.

onemstp.zip
@kayoub5
Copy link
Collaborator

kayoub5 commented Dec 6, 2020

@twa89 the link layer is determined through the constructor of CaptureFileWriterDevice, not through the Write method (the link layer of the RawCapture is simply ignored)

How did you create the CaptureFileWriterDevice ?

@twa89
Copy link
Author

twa89 commented Dec 7, 2020 via email

@kayoub5
Copy link
Collaborator

kayoub5 commented Dec 7, 2020 •
edited

@twa89 use the constructor where you can specify the LinkLayer, the one that only accepts file name uses link layer Ethernet.

See https://github.com/chmorgan/sharppcap/blob/de6d35505b9f22f9678272e431e2bce960375b94/SharpPcap/LibPcap/CaptureFileWriterDevice.cs#L160-L163

@twa89
Copy link
Author

twa89 commented Dec 7, 2020 via email

@twa89
Copy link
Author

twa89 commented Dec 10, 2020

I tried using the constructor like this and it still writes the packet as ethernet.

         FileWriter = new CaptureFileWriterDevice((PacketDotNet.LinkLayers)165,100000,CaptureFile,FileMode.Open);

@twa89
Copy link
Author

twa89 commented Dec 10, 2020

If I open that onemstp.cap file attached above in wireshark, it shows it correctly as MSTP.
I then open that file with CaptureFileWriterDevice and then write the packet to a new file.
The new file opened in wireshark is now ethernet and not decoded correctly.

@twa89
Copy link
Author

twa89 commented Dec 23, 2020

I did get this working with this signature, it was throwing an exception on the size I was passing in above too.
FileWriter = new CaptureFileWriterDevice((PacketDotNet.LinkLayers)165,65535,CaptureFile,FileMode.Open);
This is kind of a kluge with the casting, but does save the packet correctly now.

@kayoub5 kayoub5 mentioned this issue Apr 3, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@kayoub5 @twa89