[Winpcap-users] RE: first ethernet pkt gobbled by thenextone...solved

[Gianluca Varenni]

On a fast ethernet card, the maximum frame size that you can transmit with 
pcap_sendpacket is 1514 bytes, i.e. the maximum frame size for 802.3 (on 
10/100 links) from the MAC header up to the end of the frame *excluding* the 
FCS. The FCS gets added by either the NIC itself (the hardware) or the NIC 
driver (i.e. below the WinPcap driver). WinPcap does not add any byte during 
transmission before handing it down to the lower NIC miniport drivers.

On gigabit cards operating on 1Gpbs links, the maximum frame size can be 
bigger, and it mainly depends on the NIC+NIC driver that you have.

Upon reception, if the packet has a L2 payload of more than 1500 bytes, in 
the case of 10/100 links the NIC card/NIC driver usually silently drops the 
packet, unless VLAN tagging is enabled in the NIC driver. Again, on a 
gigabit link packets can have a bigger size (depending on the hardware).

At the moment I'm not aware of any off-the-shelf NIC+NIC driver that is able 
of sending frames with a L2 payload size > 1500 bytes on 10/100 links.

Have a nice day
GV

----- Original Message ----- 
From: "Har Yash Bahadur" <har.bahadur at conexant.com>
To: <winpcap-users at winpcap.org>
Sent: Tuesday, April 08, 2008 4:56 AM
Subject: RE: [Winpcap-users] RE: first ethernet pkt gobbled by 
thenextone...solved


> Hi Pedro,
>
> So you mean that specifying the parameter 'size'=1518 was incorrect in 
> pcap_sendpacket?
>
> An excerpt from WinPcap documentation is as follows:
> *********************************************************
> int pcap_sendpacket  ( pcap_t *  p,
>  u_char *  buf,
>  int  size
> )
>
> Send a raw packet.
>
> This function allows sending a raw packet to the network. p is the 
> interface that will be used to send the packet, buf contains the data of 
> the packet to send (including the various protocol headers), size is the 
> dimension of the buffer pointed by buf, i.e. the size of the packet to 
> send. >>>>The MAC CRC doesn't need to be included, because it is 
> transparently calculated and added by the network interface driver<<<<. 
> The return value is 0 if the packet is succesfully sent, -1 otherwise.
>
> *********************************************************
> It seems that 4 byte CRC which is added by WinPcap or the NIC makes the 
> total pkt to be 1518 bytes, and that restricts payload size to 1500 bytes.
>
> 1518 - 4 - 14 = 1500.
>
> I observed the same thing during reception of pkts. When the device sends 
> pkts with payload size <= 1500, they are received properly; but if payload 
> size is 1504 bytes (=> total size=1504+4+14=1518 bytes) then the pkt is 
> dropped -- does not show up on ethereal as well.
>
>
> Regards,
> Har Yash
>
> -------------------------------------------------------------
>
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Pedro Lucas
> Sent: Tuesday, April 08, 2008 2:34 PM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] RE: first ethernet pkt gobbled by the 
> nextone...solved
>
> It's not a standard sized frame per se, it's the maximum sized frame for
> transmission within IEEE 802.3. going beyond this limit would kill the
> compatibility with other standards like oldie Token Ring and newer 802.11.
> There's a an addenda to the standard to allow 1522 to include the VLAN tag
> but that's it.
> Several equipments allow oversized or jumbo frames, namely test equipments
> from Spirentcom, IXIA, using Gigabit adapters.
> That depends on the network adapter and driver. If you're going to attempt
> it using a vanilla FastEther card, it won't work.
> But Winpcap should be able to cope with it, at least I dont remember 
> looking
> at frame limiting code inside.
>
> ----- Original Message -----
> From: "Har Yash Bahadur" <har.bahadur at conexant.com>
> To: "Har Yash Bahadur" <har.bahadur at conexant.com>;
> <winpcap-users at winpcap.org>
> Sent: Tuesday, April 08, 2008 8:59 AM
> Subject: [Winpcap-users] RE: first ethernet pkt gobbled by the
> nextone...solved
>
>
>> Hi All,
>>
>> I found that WinPcap is not able to send or receive Ethernet packets of
>> size >1514 bytes (inclusive of 14 byte MAC header). The packet lost was 
>> of
>> 1518 bytes which is the standard size in case of Ethernet packets. It
>> means the payload cannot be more than 1500 (=1514 - 14) bytes.
>>
>> I tried the same thing while sending a packet and I got an error from
>> function "pcap_sendpacket". When I reduced the total size to 1514 it 
>> works
>> fine!
>>
>> Anybody has any idea why this LIMIT? Ahs anybody else faced this issue?
>>
>> Regards,
>> Har Yash
>>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> Conexant E-mail Firewall (Conexant.Com) made the following annotations
> ---------------------------------------------------------------------
> ********************** Legal Disclaimer ****************************
>
> "This email may contain confidential and privileged material for the sole 
> use of the intended recipient. Any unauthorized review, use or 
> distribution by others is strictly prohibited. If you have received the 
> message in error, please advise the sender by reply email and delete the 
> message. Thank you."
>
> **********************************************************************
>
> ---------------------------------------------------------------------
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users