Cardenas Arevalo Gustavo Antonio wrote:
I'm using Winpcap to capture packets between two PCs. they are packets TCP.
1. How can I know when a packet is fragmented? I need reassembler it.
Fragmented at what layer?
At the IP layer, the IP header has a "more fragments" flag and a fragment offset - any packet that either the "more fragments" flag set, or has a non-zero fragment offset, is a fragment. See RFC 791.
There's no notion of fragmentation at the TCP layer. The service TCP offers to protocols that use TCP is a sequence of bytes, with no notion of packets. If the protocol that uses TCP has a notion of packets, or messages, it has to put into the byte stream some indication of when packets begin and end, such as a byte count at the beginning of the packet.
2. How can I know when a packet have data? I got a Packet that It had One in the flag ACK ,and The Flag PSH is Cero.
The IP header for a TCP segment indicates how long the IP packet containing the TCP segment is - that value is in the "total length" field of the IP header. The "IHL" - Internet Header Length - field in the IP header indicates how long the IP header is; the difference between the total length and the IP header length is the amount of data in the IP packet.
That data is the TCP header and the TCP data. The TCP header contains a "data offset" field that indicates how long the TCP header is; if the length of the data in the IP packet, minus the length of the TCP header, is non-zero, then the TCP segment contains data. See RFC 793.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
