[Winpcap-users] Suppressed Packets

[Peter Hegel]

> It seems as though the D-Link card drops packets whole Ethertype/Len is 
>  > 46, i.e. packets declaring an ethernet payload size greater than 
> 46--> total packet size > 60. You are actually transmitting 60-byte 
> packets, so it's possible that the DLINK network card discards those 
> "truncated" packets.
> 
> Have you tried transmitting bigger packets (say 200 bytes) and see what 
> happens? I guess the dlink card will receive only the packets with 
> Ethertype/len < 186 (200-14) bytes.
Changing the length to 200 bytes didn't realy help. Packets with length 
0 to 2D and one with length BA (200-14) were received.

Playing with different lengt fields showed that the D-LINK driver drops 
packetes with 'invalid' length fields. Valid means that the length field 
specifies the number of data bytes (or is less than 46).

Changing sendpack.c to the following code works with the D-LINK driver, too:

   for(i=0; i<150; i++)
   {
     /* set packet size to min. 60 bytes */
     if( i < 60 )  j = 60;
     else          j = i;

     /* set 802.3 length field (packet len - header len) */
     packet[12]=(j-14)/0x100;
     packet[13]=(j-14)%0x100;

     /* send down the packet */
     if (pcap_sendpacket(fp, packet, j) != 0)
       return 3;
   }

> Hope it helps
Thank you, it helped a lot!

Peter