Greetings, Can anyone tell me why Ethereal running with the latest WinPCap beta can sniff the following ICMP echo request packet, correctly reporting its length as 47 bytes...
------------------------------------------------------------------------- Frame 63 (47 bytes on wire, 47 bytes captured) Packet Length: 47 bytes Capture Length: 47 bytes ------------------------------------------------------------------------- 0000 00 0f 66 47 42 eb 00 09 5b 30 3b a8 08 00 45 00 ..fGB... [0;...E. 0010 00 21 0a 93 00 00 01 01 2b 93 c0 a8 01 65 c0 a8 .!...... +....e.. 0020 01 01 08 00 21 67 04 00 08 00 44 48 43 50 43 ....!g.. ..DHCPC ------------------------------------------------------------------------- ...but when I stuff the same 47 bytes in a buffer and call pcap_sendpacket() with a pointer to the buffer and a length of 47, WinPCap pads the packet with $20's up to 60 bytes, causing Ethereal to capture this: ------------------------------------------------------------------------- Frame 64 (60 bytes on wire, 60 bytes captured) Packet Length: 60 bytes Capture Length: 60 bytes ------------------------------------------------------------------------- 0000 00 0f 66 47 42 eb 00 09 5b 30 3b a8 08 00 45 00 ..fGB... [0;...E. 0010 00 21 0a 93 00 00 01 01 2b 93 c0 a8 01 65 c0 a8 .!...... +....e.. 0020 01 01 08 00 21 67 04 00 08 00 44 48 43 50 43 20 ....!g.. ..DHCPC. 0030 20 20 20 20 20 20 20 20 20 20 20 20 ........ .... ------------------------------------------------------------------------- So can anyone tell me why a Motorola Ethernet card and a Linksys router can happily transmit 47-byte ICMP echo request and reply packets all day long, but pcap_sendpacket() cannot? The previous answer; "the minimum legal Ethernet packet is 60 bytes long," is not convincing in the face of the obviously-acceptable packets I've been sniffing. Am I missing something obvious here? Is this a problem in WinPCap? Thanks, Rob Henningsgard ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
