Parsing fails on a capture file where NPF_LOOPBACK adapter is present on the machine where wireshark captured the file

dotpcap / packetnet

Official repository - High performance .Net assembly for dissecting and constructing network packets such as ethernet, ip, tcp, udp etc.

Mozilla Public License 2.0

483 stars 104 forks source link

Parsing fails on a capture file where NPF_LOOPBACK adapter is present on the machine where wireshark captured the file #205

Open twa890 opened 9 months ago

twa890 commented 9 months ago

I have found that a capture file made by wireshark will not parse if there was an adapter called NPF_LOOPBACK on the machine. I figured out that the header part of the .pcapng file that lists the NICs has a single byte that is causing an exception when packet.net tries to parse it. I have added a file with this problem. I also highlighted the exact byte in a binary editor that is causing the problem. If you set that byte to 0, then it parses fine.

sampleParsingError.zip badbyte