[Winpcap-users] Partial packet after pcap_next_ex()

[Jacek Jablonski]

Hi,
thanks for your reply. These are not segments, because data pointer
after pcap_next_ex() begins with text, not headers. First chunk need
to be stripped from headers, but second begins with text. Linux always
has it in one chunk, windows always splits the same chunk (what is
more first chunk is always the same size).
Greetings,
Yacek

2009/2/12 Guy Harris <guy at alum.mit.edu>:
>
> On Feb 12, 2009, at 10:05 AM, Jacek Jablonski wrote:
>
>> Then I read packets using pcap_next_ex(). The problem is that the
>> packet contain some text. I am trying to capture it, but only some
>> part of it is being captured, then there is a garbage. After next
>> pcap_next_ex() there is just the rest of this text. What is wrong? In
>> linux I can read whole text using the same code. Please help.
>
> Are these packets TCP segments?
>
> If so, there is no guarantee that a given message - for example, an HTTP or
> FTP or SMTP request or response - won't be split across multiple TCP
> segments, so that some of the text will be in one packet and more of the
> text will be in another packet, not even on Linux.  Whether the sending
> system splits the packet between TCP segments could depend on the network
> you're running over and the TCP implementations of the sending and receiving
> machines, including whether the receiving machine (if you're running your
> application on that machine) is doing TCP segmentation offloading.
>
> In addition, are you checking the length of the packet?
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>