Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet?
I've captured a DNS query packet with Wireshark. I used the "export" feature of Wireshark to export the UDP payload to a binary file.
I'm using libnet to basically rebuild this packet and send it again.
When I resend my "custom" packet, I use Wireshark to sniff the output. The new stream is malformed only in the payload (DNS) section. I've verified that my binary output from Wireshark matches what Wireshark is showing. Cross-referencing the binary file, it matches with what I expect from the DNS specification. Am I overlooking some sort of assumption about Wireshark? Maybe I have an endian-related problem...