[Winpcap-users] Problem with automatic modification of the length/type field of mac frames

[Guy Harris]

Eduardo Escudero Sánchez wrote:
> So then as far as i have understand is the operative system the one who 
> is modifying me the length field.

It might be doing that.  It might happen in the driver for the network 
adapter, for example.

> I pass to PacketInitPacket the length 
> of all the MAC frame wgich includes: header with the source and 
> destination addresses(12 bytes), length /type field which are two bytes, 
> the data which i want to send (suppose three bytes) and the pad (43 
> bytes).

Don't do that.

Pass it the length of an *UNPADDED* MAC frame, which includes: header 
with the source and destination addresses (12 bytes), length/type field 
which are two bytes, and the data you want to send (3 bytes, for 
example), but *NOT* the pad.

> In the length / type field i put a value of three (which is the 
> length of the data) but i pass to packetsendpacket a length value of 60 
> (the length of all the frame);
> If i have understand you you are saying me the i must not put the pad by 
> myself, i must put only the data and then the operative system will put 
> the pad for me. I already have done that.

Right.

> But when the frame is received 
> in the other side its received also without pad.

I.e., you've written code that sends an 802.3 frame with 3 bytes of 
data, and passes to PacketInitPacket() a length of 12+2+3 = 17, and the 
packet, when received by the other side, doesn't include any padding, 
*and if you capture on some third machine on the network, other than the 
machine sending the packet or the machine receiving the packet* (using, 
for example, a port on a hub, or a mirrored port on a switch), the 
packet on the network has only 17 bytes in it?

Or do you just mean that the software on the *receiving* machine gets a 
packet with only 17 bytes of data (not just a packet with a length field 
of 5, but a packet with only 17 bytes of data)?

(I.e, you've *actually tried sending the frame without any padding, and 
it arrives without padding*?  You're not just saying that *will* happen, 
which isn't necessarily the case - it might not happen, if the padding 
is added by, for example, the driver for the network adapter.)