[Winpcap-bugs] (no subject)

Nurhat Uca nurhat at airties.com
Thu May 28 07:19:34 PDT 2009


Hello all, 

  I am sending a DHCP discovery packet with using libnet. And capturing
answers with winpcap. 

But the packet i captured is wrong and different from the packet
captured from wireshark.

The packets recieved are below. The packet is being broken after Magic
Cookie variable of DHCP header.

It is really very strange. 

 

Any help will be appreciated...

 

 

Wrong one captured from my program;



ff ff ff ff ff ff 00 04 23 dd fa bc 08 00 45 00 01 65 3a 3f 00 00 80 11
ea 28 0a 0b 0b 16 ff ff ff ff 00 43 00 44 01 51 a6 2d 02 01 06 00 de ad 

be ef 00 00 00 00 00 00 00 00 0a 0b fa 22 0a 0b 0b 16 00 00 00 00 00 08
a1 bb 74 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 

 

Correct one captured with wireshark;

ff ff ff ff ff ff 00 04 23 dd fa bc 08 00 45 00  01 65 1b 2b 00 00 80 11
09 3d 0a 0b 0b 16 ff ff ff ff 00 43 00 44 01 51 a6 2d 02 01 06 00 de ad

be ef 00 00 00 00 00 00 00 00 0a 0b fa 22 0a 0b  0b 16 00 00 00 00 00 08
a1 bb 74 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 02 01 04 ff


ff 00 00 3a 04 00 00 0e 10 3b 04 00 00 18 9c 33  04 00 00 1c 20 36 04 0a
0b 0b 16 03 04 0a 0b 01 01 0f 25 65 6e 67 69 6e 65 65 72 69 6e 67 2e 63


6c 69 65 6e 74 73 2e 63 6f 72 70 2e 61 69 72 74  69 65 73 2e 63 6f 6d 00
06 08 0a 0b 0b 16 0a 0d 01 16 ff


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-bugs/attachments/20090528/a7b855b2/attachment.htm 


More information about the Winpcap-bugs mailing list