This sound very strange, since no users reported problems of this kind until now. Do you confirm that caplen is *always* one byte less than len? Can you provide a small capture that shows the problem?
Loris > Hi Loris, > > I didn't set any filtering and also I don't have programs like firewalls or > PGPNet on the machine. I tried several snaplen settings like 65536, 100, > 6553 but seems they have the same problem. And to simplify the situation, I > used the example within the WinpCap developer packet called pktdump, and > this one has the same problem. > The problem only happens on WinNT 4.0 . > > Thanks a lot, > Wayne > > -----Original Message----- > From: Loris Degioanni [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, May 29, 2002 4:14 AM > To: [EMAIL PROTECTED] > Cc: Wayne Huang > Subject: Re: [WinPcap-users] caplen and len mismatch > > > Are you setting a filter? > What snaplen are you setting in pcap_open_live? > Have you programs like firewalls or PGPNet on the machine? > > > > > Hi, > > I developed an tcp traffic analysis application using Winpcap 2.3. It > works > > fine under Win2000, but I got a problem under WinNT w/ SP4 or SP6. > > > > When I check the header of the packet I got, I found there's a mismatch > > between caplen (captured length) and len (packet length), and the caplen > is > > always one byte less than len. > > > > Is there anyone who encountered this problem? > > > > Thanks in advance, > > Wayne > >
