cocowalla / Snifter

Snifter is a raw socket IP packet capturing library/app for Windows, with a tiny CPU and memory footprint
Apache License 2.0
43 stars 17 forks source link

[Bug] Regarding BitConverter and endianness #6

Closed Chigusa0w0 closed 4 years ago

Chigusa0w0 commented 5 years ago

As we know, IP, TCP and UDP protocols are transmitted in big-endian order. But BitConverter Class is not always treat data as big-endian. Instead, they use machine endianness.

Quoted from MSDN:

Similarly, the order of bytes in the array and returned by the ToIntegerValue methods and the ToChar method depends on whether the computer architecture is little-endian or big-endian.

Although this is not matter in most scenarios where Snifter calls BitConverter. This will lead to problems on a little-endian machine using -x or -y filters (port filters) as port filters uses C# built-in equality operators.

Please use a big-endian converter instead of BitConverter in IPPacket.cs: L34-35. Note that IPAddress Class constructor assumes the Int64 value to be in network byte order, so that L29-30 should not be changed.

cocowalla commented 5 years ago

Hi, thanks for mentioning this, and for the PR!

I'll try to review and merge this tomorrow 👍

cocowalla commented 4 years ago

Finally got round to looking at this - thanks for the fix!