[Winpcap-users] Partial packet after pcap_next_ex()

[Guy Harris]

On Feb 12, 2009, at 10:05 AM, Jacek Jablonski wrote:

> Then I read packets using pcap_next_ex(). The problem is that the
> packet contain some text. I am trying to capture it, but only some
> part of it is being captured, then there is a garbage. After next
> pcap_next_ex() there is just the rest of this text. What is wrong? In
> linux I can read whole text using the same code. Please help.

Are these packets TCP segments?

If so, there is no guarantee that a given message - for example, an  
HTTP or FTP or SMTP request or response - won't be split across  
multiple TCP segments, so that some of the text will be in one packet  
and more of the text will be in another packet, not even on Linux.   
Whether the sending system splits the packet between TCP segments  
could depend on the network you're running over and the TCP  
implementations of the sending and receiving machines, including  
whether the receiving machine (if you're running your application on  
that machine) is doing TCP segmentation offloading.

In addition, are you checking the length of the packet?