Hello, when i call pcap_next_ex like this "pcap_next_ex( fpI, &header, &pkt_data)" header->len and header->caplen is false in some cases. For example when capturing UDP-Packets and the UDP-Length is 00 e0 header->len is 12 higher than it should be. You can get the right length always, when adding 14 to "Total Length" of the IP-Header (because the IP-Header starts at byte 14 of pkt_data):
length=(((u_short) pkt_data[16]) << 8) + (u_short) pkt_data[17] + 14; Perhaps this is why some ppl said pcap_sendpacket damages packets (They told pcap_sendpacket to send header->len bytes!?!). With best regards Martin Klewitz ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
