Hi. We experienced a similar "problem" with one of our lab machines (using an intel server Fast Ethernet card). In practice some network cards (server nics, usually), are able to fragment outbound packets in smaller chunks (I don't know how, exactly), so they announce to protocol drivers (TCP-IP as well as winpcap) that the maximum packet size is more than 1514 bytes. As a consequence, the tcp-ip stack sends "jumbo" packets, and winpcap captures them (obviously). A workaround to the problem is to disable these features on the network card (by means of the control panel of the nic driver), if I remember well it's called "offload TCP segmentation" on my machine.
Hope it helps GV ----- Original Message ----- From: "Pawan Singh" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, April 19, 2004 1:48 AM Subject: [WinPcap-users] Winpcap 3.1 beta: Problem with packet length and captured length > Hi, > > I am using winpcap 3.1 beta. I am seeing IP packets on an 100 Mbit Ethernet > segment which have IP header total length > 2000. This causes Winpcap > library to return packet length and captured length to be greater equal to > IP total length + Ethernet header length. > > Is this a bug in winpcap because captured length should never be greater > than 1536 on an Ethernet segment? In such a case, how does the driver even > return these extra bytes (i.e. after 1536) because Ethernet card should > never provide a packet data more than 1536 bytes. > > Thanks > Pawan Singh > [EMAIL PROTECTED] > > > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
