On Aug 9, 2004, at 8:35 AM, Rob Henningsgard wrote:
Well, it doesn't appear to be my fault. I have two machines tied together
with a crossover cable. Both are running WinPCap 3.1 beta 3. One is running
Ethereal, and that one has successfully logged 59-byte packets, created
by a web server running SSL (one of the SSL handshake packets works out
to be 59 bytes every time).
Are the packets it's logging packets being *sent* by the machine running Ethereal?
If so, then note that the padding of the packet payload to 60 bytes - which is, as Fulvio noted, *REQUIRED* on Ethernets, so if your application depends on getting an un-padded packet, it won't work on Ethernet, so if you're running your own protocol atop Ethernet you'll have to change that protocol to include a packet length in the packet data - will be seen only on packets *received* by the machine. Packets sent by the machine will be handed to the packet capture mechanism before they're transmitted (as Ethernet interfaces don't supply packets that they transmit back to the host transmitting them), and they are typically not padded before that's done.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
