UDP Port Replication - SharpPCap BSOD

261 Views Asked by At

I wrote simple program using sharppcap to replicate incomming udp packets to another port. Lets say, I have incomming packets on port 25000, I will receive them using sharppcap, create new Ethernet packet identical to prevoius one and only change the Destination port to 27000 and then send the packet.

Program is working exactly how I wanted to, I am receiving same UDP packet on port 25000 and port 27000.

But after some time, sometimes is 1 hour, sometimes 2 hours, sometimes 12 hours I will get BSOD. I have no idea, what exactly is causing the BSOD (in minidump I just know its kernel and hal.dll) and in address tree, the first if "ipnat.sys".

Here is my code:

device.OnPacketArrival += new PacketArrivalEventHandler(device_OnPacketArrival);
            // Open the device for capturing
            device.Open();
            device.Filter = $"udp dst port {_portIncomming} and ip src not {_ipSource}";
            // Start capture 'INFINTE' number of packets
            device.Capture();
            // Close the pcap device
            // (Note: this line will never be called since
            //  we're capturing infinite number of packets
            device.Close();

And receive:

private static void device_OnPacketArrival(object sender, CaptureEventArgs e)
        {
            var device = e.Device;
            var packet = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
            if (packet is EthernetPacket)
            {
                var eth = packet.Extract<EthernetPacket>();
                var ip = eth.Extract<IPPacket>();
                if (ip != null)
                {
                    var udp = packet.Extract<UdpPacket>();
                    device.SendPacket(CreateDuplicate(eth.SourceHardwareAddress, eth.DestinationHardwareAddress, udp.PayloadData, ip.SourceAddress, ip.DestinationAddress));                                        
                }                                
            }
        }

And CreateDuplicate:

private static EthernetPacket CreateDuplicate(PhysicalAddress source, PhysicalAddress dest, byte[] data, IPAddress ipSource, IPAddress ipDest)
        {
            ushort udpSourcePort = _portIncomming;
            ushort udpDestinationPort = _newDestPort;
            var udpPacket = new UdpPacket(udpSourcePort, udpDestinationPort);

            var ipSourceAddress = ipSource;
            var ipDestinationAddress = ipDest;
            var ipPacket = new IPv4Packet(ipSourceAddress, ipDestinationAddress);                       

            var ethernetSourceHwAddress = source;
            var ethernetDestinationHwAddress = dest;

            // NOTE: using EthernetPacketType.None to illustrate that the Ethernet
            //       protocol type is updated based on the packet payload that is
            //       assigned to that particular Ethernet packet
            var ethernetPacket = new EthernetPacket(ethernetSourceHwAddress,
                ethernetDestinationHwAddress,
                EthernetType.None);

            // Now stitch all of the packets together
            udpPacket.PayloadData = data;
            udpPacket.ParentPacket = ipPacket;
            ipPacket.PayloadPacket = udpPacket;
            ethernetPacket.PayloadPacket = ipPacket;

            ipPacket.UpdateIPChecksum();
            udpPacket.Checksum = udpPacket.CalculateUdpChecksum();
            ethernetPacket.UpdateCalculatedValues();

            //byte[] packetBytes = ethernetPacket.Bytes;
            return ethernetPacket;
        }

Do you have some idea or some tip or already written program which is solving my problem. Running OS: Windows Server 2012 R2

0

There are 0 best solutions below