4

Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet?

Longer story:

I've captured a DNS query packet with Wireshark. I used the "export" feature of Wireshark to export the UDP payload to a binary file.

I'm using libnet to basically rebuild this packet and send it again.

When I resend my "custom" packet, I use Wireshark to sniff the output. The new stream is malformed only in the payload (DNS) section. I've verified that my binary output from Wireshark matches what Wireshark is showing. Cross-referencing the binary file, it matches with what I expect from the DNS specification. Am I overlooking some sort of assumption about Wireshark? Maybe I have an endian-related problem...

Improve this question
3
  • Did you recalculate the checksum?
    – Ron Maupin ♦
    Nov 7, 2015 at 14:09
  • you need to elaborate on "malformed"
    – Alnitak
    Nov 19, 2015 at 10:09
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 12, 2017 at 20:52

1 Answer 1

Reset to default
2

TCPReplay can be used to replay UDP traffic from a filtered and exported packet capure. Note that it will not work with multiple TCP streams due to issues with the sequence numbers.

You may also be able to get this to work with netcat.

Unfortunately, there is not yet a way to do multiple TCP streams, but fortunately that is not an issue for you.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.