Send Raw IP packet in C#, everything above the ethernet layer

Question

I don't want to modify the ethernet portions of the frame, but I need to modify the IP packet and the data portion of the frame.

I try sending a raw frame and it still puts in the IP information. I basically need to send a frame without defining the endpoint except in the bits I'm sending.

Here's what I got:

Socket s = new Socket(AddressFamily.Unspecified, SocketType.Raw, ProtocolType.Raw);
EndPoint ep = new IPEndPoint(IPAddress.Parse("205.188.100.58"),80);
s.SendTo(GetBytes(""),ep); //im sending nothing, so i expect the frame to just have ethernet stuff
s.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, false);

My question: Using SendTo adds the IP portion of the frame, I don't want that as I want to spoof the source IP. Using "Send" will crash because it says I need to specify an endpoint. Any suggestions on what to do? I just want to send a packet and define the IP section and data section myself.

Note: No I'm not making a DOS attack, I need this for a legitimate use!

I know how to define the IP portion, its just a matter of actually sending the data without a generated IP portion.

Solution 1

Your question is very well answered here: How send raw ethernet packet with C#?

Using Pcap.Net sort of a library, you can easily modify individual data packets in any way you want (as it uses the underlaying WinPcap implementation which is very powerful).

You can also completely skip the IP layer and send to MAC addresses as in: http://www.codeproject.com/KB/IP/sendrawpacket.aspx where I used a similar approach to communicate with a micro-controller (Atmel ATmega) over Ethernet which provides almost realtime communications.

Solution 2

"Using Pcap.Net sort of a library, you can easily modify individual data packets in any way you want (as it uses the underlaying WinPcap implementation which is very powerful)."

Wrong! WinPcap cant do filtering/packet dropping/ create packet. By other words, its just lets you monitor the packet in an async fashion...

Raw packet /Promiscuous mode/ Driver filter / packet routing is another talk.

Comments

[brandon]

I saw that earlier, I was really hoping I could just do it straight in System.Net.Socket. Blah oh well

[Teoman Soygul]

System.Net.Socket is a wrapper around Winsock so you can P/Invoke and use Winsock directly but using Pcap.Net will be much better.

[brandon]

ya just realized that. Good find. thanks for the clarification