On Jan 10, 2005, at 2:02 PM, Guy Harris wrote:
However, checking for a length > 60 is probably close enough on Ethernet. It might catch some TCP segments with a small amount of data (14+20+20+6 = 60, so, for example, TCP segments with up to 6 bytes and no IP or TCP options would be captured), but that's probably better than *not* capturing TCP segments that *do* have data.
No, it might *reject* TCP segments with a small amount of data, so it *is* not capturing TCP segments that do have data.
Unfortunately, given the padding of Ethernet packets, the only way not to reject any TCP segments with data and not to accept any TCP segments with data is to compute the TCP payload length and check that, as per my previous message.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
