sharppcap icon indicating copy to clipboard operation
sharppcap copied to clipboard

ipv6 packets could not be parsed

Open jeowill-zhou opened this issue 1 year ago • 2 comments

pp2.zip

it looks abnormal when using ipv6 packets

    private void Reader_OnPacketArrival(object sender, PacketCapture e)
    {

            if (rawpacket.LinkLayerType != LinkLayers.Ethernet)
            {
                return null;
            }

            var packetLength = rawpacket.Data.Length;
            var ethPacket = Packet.ParsePacket(rawpacket.LinkLayerType, rawpacket.Data) as EthernetPacket;
            var ipPacket = ethPacket.Extract<IPPacket>();

           //ipPacket.Protocol is 0x09  which not in enum values
          // I cannot convert the ipPacket to IPv6Packets

    }

jeowill-zhou avatar Jul 17 '24 16:07 jeowill-zhou

   CaptureFileReaderDevice reader = new CaptureFileReaderDevice("d:\\pp2.pcap");
   reader.OnPacketArrival += Reader_OnPacketArrival;
   reader.Open();
   reader.Filter = "";
   reader.Capture();
   reader.Close();

jeowill-zhou avatar Jul 17 '24 16:07 jeowill-zhou

@jeowill-zhou how did you generate this pcap?

It has bogus/incorrect Ethernet header

image

kayoub5 avatar Jul 28 '24 13:07 kayoub5

No feedback, closing.

@PhyxionNL up to you if you want to support those broken packets that use the wrong EtherType.

Wireshark seems to support them at least.

kayoub5 avatar Sep 15 '24 20:09 kayoub5