[Winpcap-users] pcap_sendpacket() and padding

[Guy Harris]

Marcel van Lieshout wrote:
> hmm, when testing with transmitting undersized packets, etherreal shows
> the
> short size. No padding is shown. Is this a limitation of etherreal?

If you mean that you're running Ethereal on the machine that's
transmitting the packets, and when you capture them with Ethereal they
show up as not padded, that's a limitation of the way the packet capture
mechanism libpcap/WinPcap uses works (so you'll see it with any
application that uses libpcap/WinPcap or otherwise uses that packet
capture mechanism, such as tcpdump/WinDump, not just Ethereal).

When a packet is transmitted, in most if not all of the packet capture
mechanisms (so this isn't unique to Windows/WinPcap), a copy of the packet
is internally copied to the packet capture mechanism *before* it's padded
and transmitted.