[Winpcap-users] Partial packet after pcap_next_ex()

[Jacek Jablonski]

Sorry for my mistake. The same situation occurs in linux and windows.
Greetings,
Yacek

2009/2/12 Jacek Jablonski <yacek87 at gmail.com>:
> Hi,
> thanks for your reply. These are not segments, because data pointer
> after pcap_next_ex() begins with text, not headers. First chunk need
> to be stripped from headers, but second begins with text. Linux always
> has it in one chunk, windows always splits the same chunk (what is
> more first chunk is always the same size).
> Greetings,
> Yacek
>
> 2009/2/12 Guy Harris <guy at alum.mit.edu>:
>>
>> On Feb 12, 2009, at 10:05 AM, Jacek Jablonski wrote:
>>
>>> Then I read packets using pcap_next_ex(). The problem is that the
>>> packet contain some text. I am trying to capture it, but only some
>>> part of it is being captured, then there is a garbage. After next
>>> pcap_next_ex() there is just the rest of this text. What is wrong? In
>>> linux I can read whole text using the same code. Please help.
>>
>> Are these packets TCP segments?
>>
>> If so, there is no guarantee that a given message - for example, an HTTP or
>> FTP or SMTP request or response - won't be split across multiple TCP
>> segments, so that some of the text will be in one packet and more of the
>> text will be in another packet, not even on Linux.  Whether the sending
>> system splits the packet between TCP segments could depend on the network
>> you're running over and the TCP implementations of the sending and receiving
>> machines, including whether the receiving machine (if you're running your
>> application on that machine) is doing TCP segmentation offloading.
>>
>> In addition, are you checking the length of the packet?
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>