On Thu, Feb 23, 2012 at 6:31 AM, Andriy Tylychko <[email protected]> wrote: > I capture network traffic on Debian 5 and 6 with libpcap v. 1.2.1 compiled > from sources. Then I send these traffic by pcap_sendpacket(). Sometimes > there're packets (both TCP and UDP) larger than default MTU size (1500 > bytes). I cannot send these packets with error: "send error: > packetSendPacket failed". Found this post: > http://seclists.org/tcpdump/2007/q2/112 "[Patch] libpcap support for IP > fragment reassembly", but I didn't enable such reassemply.
Open your pcap in wireshark... see what's there beyond the 1500 byte limit. I'm going to guess it's the ethernet trailer and not re-assembled IP fragements. Easiest to do it remove the trailer with something like tcprewrite. -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
