|
Hi :
I was using pcap (libpcap-2003.10.21) to
develop a set of protocol. The first thing came up is to make pcap writable, I
followed Gary R. Wright's guide at http://www.kohala.com/start/writepcap.txt.
The only thing I did is modified pcap_bpf.c file and
change the call to ope() from O_RDONLY to O_RDWR. than call write(pd->fd,
.....) to write data into pcap.
I am running my test in RH linux 7.2, Interesting thing
happened. If I write packet which size smaller than 60 bytes, the receving
program will always capture packet sized 60 bytes. anything greater than
60 bytes will showed up as actually buffer size I've written. The frame I
built is just ethernet header followed by some other test data.
In both cases. I got the correct ethernet header, but the
following data is missing and replaced by some strange data. I don't know
where it come from.
Anybody knows how could this happen? Does pcap
automatically append ip or tcp header ? or whatever data ?
Thank you!
chris. |
