How can i properly parse a RAW(Raw Ip) packet with C#?

Question

I need to parse a pcap file in C# that was generated in Wireshark. Of course it opens fine with wireshark and shows all packets as expected.

I have tried to work with two popular libraries (Pcap.Net and Packet.net from SharpPcap) I've found online, but neither work.

Pcap.Net seems it cannot parse Raw IP packets. I can see from the debugger that the DataLink is "RAW (Raw IP)" and as I query other properties in the debugger, I get several System.NotSupportedExceptions saying things like "PcapDataLink 12 - RAW (Raw IP) is unsupported"

Packet.net but it also has a similar error when trying to parse the same file.

I'm surprised that both of these libraries are choking on this.

I'm wondering if I'm doing something wrong with these libraries as this is the first pcap file I tried and I'm getting errors on what seem like a simple packet.

Is there is another library that does support Raw IP packets?

Answer 1

You're absolutely right, Pcap.Net didn't support it.

I've just submitted a Change Set to add support for this, so the next version of Pcap.Net will have support for such packets built in.

More details in the relevant discussion in Pcap.Net forum.