Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet?

Longer story:

I've captured a DNS query packet with Wireshark. I used the "export" feature of Wireshark to export the UDP payload to a binary file.

I'm using libnet to basically rebuild this packet and send it again.

When I resend my "custom" packet, I use Wireshark to sniff the output. The new stream is malformed only in the payload (DNS) section. I've verified that my binary output from Wireshark matches what Wireshark is showing. Cross-referencing the binary file, it matches with what I expect from the DNS specification. Am I overlooking some sort of assumption about Wireshark? Maybe I have an endian-related problem...

  • Did you recalculate the checksum? – Ron Maupin Nov 7 '15 at 14:09
  • you need to elaborate on "malformed" – Alnitak Nov 19 '15 at 10:09
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 20:52

TCPReplay can be used to replay UDP traffic from a filtered and exported packet capure. Note that it will not work with multiple TCP streams due to issues with the sequence numbers.

You may also be able to get this to work with netcat.

Unfortunately, there is not yet a way to do multiple TCP streams, but fortunately that is not an issue for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.