[Winpcap-users] Where the apdding begins?

[Krzysztof Włodarczyk]

Hi, 

my problem is how to find out where, in a tcp packet, finishes tcp data, and begins a padding??

for example I have the following packet:
00 50 fc a1 50 cb 00 30  4f 18 3a d8 08 00 45 00  
00 2d 47 52 40 00 3a 06  fd 60 d4 4d 65 a6 c0 a8  
01 7c 00 6e 08 a9 0c f8  00 cc 62 09 bd db 50 18  
16 d0 e5 c2 00 00 2b 4f  4b 0d 0a 62 

where:
00 50 fc a1 50 cb 00 30  4f 18 3a d8 08 00
-is an Ethernet header

                                           45 00  
00 2d 47 52 40 00 3a 06  fd 60 d4 4d 65 a6 c0 a8  
01 7c 
-is an IPv4 header

      00 6e 08 a9 0c f8  00 cc 62 09 bd db 50 18  
16 d0 e5 c2 00 00 
-is a TCP header

 2b 4f  4b 0d 0a 
-is TCP data

and finally:
 62
-is a padding rubbish

The two TCP crc-s:
without rubbish: 0xe5c2 - ok
with rubbish: 0xe55f - wrong

And my question: is there any method that can tell me where the padding begins? (other than counting multiple CRC and comparing it to a proper TCP field;))

----------------------------------------------------
Jeden mężczyzna, trzy kobiety, cztery tajemnice 
PO SEZONIE w kinach od 31 marca 2006 r. 
http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fpo_sezonie.html&sid=714