[Winpcap-users] UDPdump

[Maria de Fatima Requena]

Hi. First of all, thanks for your reply. I have actually fixed it, and
the problem was as you sayd, byte order. Using ntohs over
udp_header->len works it out

Thanks again

-----Mensaje original-----
De: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] En nombre de Gianluca Varenni
Enviado el: viernes, 28 de diciembre de 2007 16:54
Para: winpcap-users at winpcap.org
Asunto: Re: [Winpcap-users] UDPdump


----- Original Message ----- 
From: "Maria de Fatima Requena" <MariaF.Requena at a-e.es>
To: <winpcap-users at winpcap.org>
Sent: Friday, December 21, 2007 4:58 AM
Subject: [Winpcap-users] UDPdump


> Hi. I'm transforming your example code in order to use SIP packets,
> which are supposed to be udp datagram. I'm using field uh->len in
order
> to work out the size of the SIP packet, but I get a number much bigger
> than it should be. For example: I get a size of about 5000 for a
packet
> of 600.
>
> Which unit is uh->len in?(bits, bytes...)Why is it said in the comment
> to be datagram length, while the UDP specification says that it must
be
> the size of the whole udp packet?
>

The unit is bytes. Regarding the comment, i think it's not precise. In
the 
specific case, by datagram it means udp header + payload.

Regarding the strange number you get (5000 when the packet size is 600),
two 
things come to my mind:
1. you forgot to conver the length from network byte order to host byte 
order
2. the original UDP packet was actually 5000 bytes, and it got
fragmented 
into multiple IP fragments.

I would try receiving the same packets with wireshark and see how
wireshark 
decodes them.

Have a nice day
GV


> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users 

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users