Hi, I'm writing a piece of code with the libpcap() library that works out the next sequence number expected from the payload length. I'm concerned only with the tcp/ip protocol. I expected that during the three-way handshake of tcp, that the first two packets from the initiating TCP entity will NOT have any data in them. The first two packets are the SYN and the ACK to the other TCP entity's SYN.
However, my code suggests that on some http connections, these packets hold data, which breaks my code. I calculate the payload length using pkt_header->caplen - tcp_len - ip_len - linklayer_len where tcp_len and ip_len are taken from the appropriate fields in their respective headers, and linklayer_len is always 14 because it is an ethernet header. Can someone please confirm that these packets are not supposed to have a payload? Thanks in advance, Justin - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
