I can read arp packets with winpcap that are 48 bytes size, Winpcap cannot read erroneus packets but smaller it can read.
David. Regards. ----- Original Message ----- From: "Rob Henningsgard" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, August 24, 2004 10:42 AM Subject: [WinPcap-users] 60 Byte Minimum Packet, really? > Greetings, > > Can anyone tell me why Ethereal running with the latest WinPCap beta > can sniff the following ICMP echo request packet, correctly reporting its > length as 47 bytes... > > ------------------------------------------------------------------------- > Frame 63 (47 bytes on wire, 47 bytes captured) > Packet Length: 47 bytes > Capture Length: 47 bytes > ------------------------------------------------------------------------- > 0000 00 0f 66 47 42 eb 00 09 5b 30 3b a8 08 00 45 00 ..fGB... [0;...E. > 0010 00 21 0a 93 00 00 01 01 2b 93 c0 a8 01 65 c0 a8 .!...... +....e.. > 0020 01 01 08 00 21 67 04 00 08 00 44 48 43 50 43 ....!g.. ..DHCPC > ------------------------------------------------------------------------- > > ...but when I stuff the same 47 bytes in a buffer and call pcap_sendpacket() > with a pointer to the buffer and a length of 47, WinPCap pads the packet > with $20's up to 60 bytes, causing Ethereal to capture this: > > ------------------------------------------------------------------------- > Frame 64 (60 bytes on wire, 60 bytes captured) > Packet Length: 60 bytes > Capture Length: 60 bytes > ------------------------------------------------------------------------- > 0000 00 0f 66 47 42 eb 00 09 5b 30 3b a8 08 00 45 00 ..fGB... [0;...E. > 0010 00 21 0a 93 00 00 01 01 2b 93 c0 a8 01 65 c0 a8 .!...... +....e.. > 0020 01 01 08 00 21 67 04 00 08 00 44 48 43 50 43 20 ....!g.. ..DHCPC. > 0030 20 20 20 20 20 20 20 20 20 20 20 20 ........ .... > ------------------------------------------------------------------------- > > So can anyone tell me why a Motorola Ethernet card and a Linksys router > can happily transmit 47-byte ICMP echo request and reply packets all > day long, but pcap_sendpacket() cannot? The previous answer; "the > minimum legal Ethernet packet is 60 bytes long," is not convincing in > the face of the obviously-acceptable packets I've been sniffing. > > Am I missing something obvious here? Is this a problem in WinPCap? > > Thanks, > > Rob Henningsgard > > > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
