[Winpcap-users] Size of packet captured!

[tran thanh]

Dear Chang,
Yes I got a packet only have 1516 bytes, so I must join 2 pakets to get the
all message,
So in this case if the message is too long there will be more and more
pakets,
how do I know which pakets is from a message to join it together!

P/S: I'm reading your link, it's very helpful, but I still not know how to
resolve the problem.
Regard,
Tran Bach Thanh.


On Fri, Jul 24, 2009 at 10:09 AM, David Chang <dchang at fsautomation.com>wrote:

>  Tran,
>
> Standard TDS headers are 4 bytes long.  The first byte is the 'packet
> type'.  The second byte is the 'last packet indicator'.  The next two bytes
> are the 'packet size'.  Thus, in your case, you should have gotten a 'packet
> size' that was greater than one Ethernet packet length (around 1500 bytes).
>
> I suggest you look at: http://www.freetds.org/tds.html
>
> DC
>
> ----- Original Message -----
> *From:* tran thanh <xbachngoctuyetx at gmail.com>
> *To:* winpcap-users at winpcap.org
> *Sent:* Thursday, July 23, 2009 7:31 PM
> *Subject:* Re: [Winpcap-users] Size of packet captured!
>
> Dear Varenni and Chang,
> Firstly thanks for your help,
> I'm using TCP!
> I got Full TDS message from 2 packets,
> But new matter is how do I know that 2(or more) pakets is from a TDS
> message?
> Thanks,
> Tran Bach Thanh!
>
>
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090724/bd47f889/attachment.htm