Cannot Convert from SharpPcap.RawCapture to PacketDotNet.Packet

Question

I followed the guide at http://www.codeproject.com/KB/IP/sharppcap.aspx to implement a simple packet sniffer to automate authentication for me, I managed to go to the "Filtering" section, and still they had to make some adjustments to the tutorial code, but now I'm at a standstill.

The error I am getting is:

The best overloaded method match for 'PacketDotNet.TcpPacket.GetEncapsulated (PacketDotNet.Packet)' has some invalid arguments

Argument 1: Cannot be converted from "SharpPcap.RawCapture" to "PacketDotNet.Packet"

But I don't need to reference PacketDotNet yet (I still had SharpPcap).

All the code that I still have included, the problem is the device_OnPacketArrival () function.

using System; using System.Collections.Generic; using System.Linq; using System.Text; using PacketDotNet; using SharpPcap; namespace ConsoleApplication1 { class Program { static void Main(string[] args) { string ver = SharpPcap.Version.VersionString; Console.WriteLine("SharpPcap {0}, Example1.IfList.cs", ver); // Retrieve the device list CaptureDeviceList devices = CaptureDeviceList.Instance; // If no devices were found print an error if (devices.Count < 1) { Console.WriteLine("No devices were found on this machine"); return; } // Extract a device from the list ICaptureDevice device = devices[0]; // Register our handler function to the // 'packet arrival' event device.OnPacketArrival += new SharpPcap.PacketArrivalEventHandler(device_OnPacketArrival); // Open the device for capturing int readTimeoutMilliseconds = 1000; device.Open(DeviceMode.Promiscuous, readTimeoutMilliseconds); // tcpdump filter to capture only TCP/IP packets string filter = "ip and tcp"; device.Filter = filter; Console.WriteLine(); Console.WriteLine("-- The following tcpdump filter will be applied: \"{0}\"", filter); Console.WriteLine("-- Listening on {0}, hit 'Enter' to stop...", device.Description); // Start capturing packets indefinitely device.Capture(); // Close the pcap device // (Note: this line will never be called since // we're capturing indefinitely device.Close(); } private static void device_OnPacketArrival(object sender, CaptureEventArgs e) { var tcp = TcpPacket.GetEncapsulated(e.Packet); } } } 

Answer 1

SharpPcap.RawPacket is used to store the raw data captured by the network adapter, but PacketDotNet needs packet analysis before the GetEncapsulated () methods work. The step you need will look like this:

 var packet = PacketDotNet.Packet.ParsePacket(rawPacket.LinkLayerType, rawPacket.Data); 

You can then retrieve the encapsulated TcpPacket using the GetEncapsulated() method by passing it a packet .

Example 12 in the SharpPcap download source at https://sourceforge.net/projects/sharppcap/ shows the syntax and method for modifying packages.

Keep in mind that PacketType.GetEncapsulated() returns a link to this part of the package, so changing it will change the original package.

Answer 2

Alternatively, you can use Pcap.Net , which has only one package class that you can dynamically parse to get what it can contain without doing any package.

You just get the Packet object and do (for example):

 uint sequenceNumber = packet.Ethernet.IpV4.Tcp.SequenceNumber; 

No need to drop it or know which package it is in advance, all parses are performed dynamically.

Answer 3

As an update for Chris Morgan's answer (because I'm doing it now), getEncapsulated() now deprecated, instead you should use packet.Extract() to retrieve the encapsulated packet.