[Winpcap-users] Where the apdding begins?

[shauli.rozen at gmail.com]

  I hope I am not misleading you.
  But I don't think there is padding on the tcp data.
  padding is only inside the header , before the tcp data begins.
  any way , you can use the total length field from the ip header +
calculations
  to find the data length.


On 4/1/06, Krzysztof Włodarczyk <krwl at wp.pl> wrote:
>
> Hi,
>
> my problem is how to find out where, in a tcp packet, finishes tcp data,
> and begins a padding??
>
> for example I have the following packet:
> 00 50 fc a1 50 cb 00 30  4f 18 3a d8 08 00 45 00
> 00 2d 47 52 40 00 3a 06  fd 60 d4 4d 65 a6 c0 a8
> 01 7c 00 6e 08 a9 0c f8  00 cc 62 09 bd db 50 18
> 16 d0 e5 c2 00 00 2b 4f  4b 0d 0a 62
>
> where:
> 00 50 fc a1 50 cb 00 30  4f 18 3a d8 08 00
> -is an Ethernet header
>
>                                           45 00
> 00 2d 47 52 40 00 3a 06  fd 60 d4 4d 65 a6 c0 a8
> 01 7c
> -is an IPv4 header
>
>      00 6e 08 a9 0c f8  00 cc 62 09 bd db 50 18
> 16 d0 e5 c2 00 00
> -is a TCP header
>
> 2b 4f  4b 0d 0a
> -is TCP data
>
> and finally:
> 62
> -is a padding rubbish
>
> The two TCP crc-s:
> without rubbish: 0xe5c2 - ok
> with rubbish: 0xe55f - wrong
>
> And my question: is there any method that can tell me where the padding
> begins? (other than counting multiple CRC and comparing it to a proper TCP
> field;))
>
> ----------------------------------------------------
> Jeden mężczyzna, trzy kobiety, cztery tajemnice
> PO SEZONIE w kinach od 31 marca 2006 r.
>
> http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fpo_sezonie.html&sid=714
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20060401/9adbee76/attachment.htm