[Winpcap-users] Any way to read MTU from theinterface/network-adapter ?

[Per Ellefsen]

Hi!

Thank you very much for your reply Eric.

I believe the value in the registry is a default value, and
the actual MTU set for the interface may have been changed by 
any driver using the interface.

A good idea to use the MSS sent with the SYN.
The MSS sent in the SYN is really MRU-40, but usually 
MTU is equal to MRU, so this should work.
I will look at this !

BR Per



-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Eric Kollmann
Sent: 21. oktober 2008 16:36
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Any way to read MTU from
theinterface/network-adapter ?

Not sure about using winpcap or a system call, but it is available in
the registry to tweak:
http://www.irongeek.com/i.php?page=security/osfuscate-change-your-window
s-os-tcp-ip-fingerprint-to-confuse-p0f-networkminer-ettercap-nmap-and-ot
her-os-detection-tools

You need to know what interface, but it is listed in this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\In
terfaces\*\MTU
where * is the actual interface.

The other option, as I recall, is if the device sends out a MSS value in
its SYN packet, to take that value and add 40 to it (not sure how
reliable that is), but that is how I do it in my passive identification
program if I recall correctly.

Eric

On Tue, Oct 21, 2008 at 7:15 AM, Per Ellefsen
<per.ellefsen at ericsson.com> wrote:
>
> Hi !
>
> I am using WinPcap for both send and receive traffic towards the
network adapter.
> Does anybody know if it is possible to read out the MTU size 
> configured for the adapter ?
> ....using WinPcap or any system-call ?
>
> BR Per
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users