search

mfontanini / libtins

High-level, multiplatform C++ network packet sniffing and crafting library.
http://libtins.github.io/
BSD 2-Clause "Simplified" License
1.92k stars 379 forks source link

hex string of ICMPv6 #248

Open bipindas123 opened 7 years ago

bipindas123 commented 7 years ago

Hi,

i am trying to get the hex string of ICMPv6 packet from one IP packet. Tried with following way.

ICMPv6 icmp = ipv6.rfind_pdu(); PDU::serialization_type buffer = icmp.serialize();

i can see , only first byte of buffer is correct. Rest bytes are corrupted. icmp object is correct, but it gives corrupted when we do serialization.

mfontanini commented 7 years ago

Can you specify what exactly do you mean by "bytes are corrupted"? Also, can you attach a pcap that contains an ICMPv6 packet with which I can reproduce this?

bipindas123 commented 7 years ago

i mean when i am extracting hex string from ICMPv6 packet using serialize(), then hex string is not exactly same as original.

check this attached icmpv6 packet. fillter this with icmpv6.

RSpacket.zip

mfontanini commented 7 years ago

When you serialize a PDU, it will compute any checksums it contains (ICMPv6 has a checksum). In this case you're copying the ICMPv6 PDU (you're not storing a reference to it), which makes it lose track of its parent PDU which is IPv6. The checksum on ICMPv6 relies on values of the IPv6 header, hence the checksum is reset to 0 and not actually computed.

If you want to get the right serialization, just don't create a copy of the packet:

ICMPv6& icmp = ipv6.rfind_pdu();
bipindas123 commented 7 years ago

thank you . i will check and update you

mfontanini commented 7 years ago

Any updates on this?

bipindas123 commented 7 years ago

I could not check this. I will check and let you know.

On Tue, Oct 3, 2017 at 4:07 AM, Matias Fontanini notifications@github.com wrote:

Any updates on this?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mfontanini/libtins/issues/248#issuecomment-333684983, or mute the thread https://github.com/notifications/unsubscribe-auth/AYzMS4N8PPBXr4pNECmxCK1ItaVID7WUks5soWWzgaJpZM4PYjJm .