"{Pedro Lucas-Suporte Netcount}" <[EMAIL PROTECTED]> said:
> With Ethereal or with my software using mode
> NDIS_PACKET_TYPE_ALL_LOCAL/NDIS_PACKET_TYPE_PROMISCUOUS, some frames sent
> from my machine are captured by the machine with only 54 Bytes. The frames
> (e.g. fromEmule) have 60 Bytes: IP_payload(40B) + SA(6B) + DA(6B) + Type(2B)
> + Padding(6B) . Looks like the padding after the IP layer is lost.
It's normal. Why would packets looped internally need padding?
The padding normally (always?) happens just before it's sent in the
LAN-card driver. WinPcap gets a copy from NDIS before this happens.
--gv
==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use
mailto: [EMAIL PROTECTED]
==================================================================
