[Winpcap-bugs] Wrong packet data captured with winpcap

[Nurhat Uca]

Hello,

It is the first time i am using winpcap. So, sometimes can do mistakes. 

 I found the reason

  pcap_open_live((char*)ifname, 100, promisc, 10, ebuf) changed to

  pcap_open_live(intf, 65536, promisc, 1000, ebuf).

 

The packet length was higher than 100. So i coud not get the whole
packet.

 

Thanks

NU

________________________________

From: Gianluca Varenni [mailto:gianluca.varenni at cacetech.com] 
Sent: Thursday, May 28, 2009 8:36 PM
To: Nurhat Uca; winpcap-bugs at winpcap.org
Subject: Re: [Winpcap-bugs] Wrong packet data captured with winpcap

 

Can you show some code of your application?

 

Have a nice day

GV

	----- Original Message ----- 

	From: Nurhat Uca <mailto:nurhat at airties.com>  

	To: winpcap-bugs at winpcap.org 

	Sent: Thursday, May 28, 2009 7:21 AM

	Subject: [Winpcap-bugs] Wrong packet data captured with winpcap

	 

	Hello all, 

	  I am sending a DHCP discovery packet with using libnet. And
capturing answers with winpcap. 

	But the packet i captured is wrong and different from the packet
captured from wireshark.

	The packets recieved are below. The packet is being broken after
Magic Cookie variable of DHCP header.

	It is really very strange. 

	 

	Any help will be appreciated...

	 

	 

	Wrong one captured from my program;

	ff ff ff ff ff ff 00 04 23 dd fa bc 08 00 45 00 01 65 3a 3f 00
00 80 11 ea 28 0a 0b 0b 16 ff ff ff ff 00 43 00 44 01 51 a6 2d 02 01 06
00 de ad 

	be ef 00 00 00 00 00 00 00 00 0a 0b fa 22 0a 0b 0b 16 00 00 00
00 00 08 a1 bb 74 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 

	 

	Correct one captured with wireshark;

	ff ff ff ff ff ff 00 04 23 dd fa bc 08 00 45 00  01 65 1b 2b 00
00 80 11 09 3d 0a 0b 0b 16 ff ff ff ff 00 43 00 44 01 51 a6 2d 02 01 06
00 de ad

	be ef 00 00 00 00 00 00 00 00 0a 0b fa 22 0a 0b  0b 16 00 00 00
00 00 08 a1 bb 74 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00  

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00  

	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 02
01 04 ff  

	ff 00 00 3a 04 00 00 0e 10 3b 04 00 00 18 9c 33  04 00 00 1c 20
36 04 0a 0b 0b 16 03 04 0a 0b 01 01 0f 25 65 6e 67 69 6e 65 65 72 69 6e
67 2e 63  

	6c 69 65 6e 74 73 2e 63 6f 72 70 2e 61 69 72 74  69 65 73 2e 63
6f 6d 00 06 08 0a 0b 0b 16 0a 0d 01 16 ff


	
________________________________


	_______________________________________________
	Winpcap-bugs mailing list
	Winpcap-bugs at winpcap.org
	https://www.winpcap.org/mailman/listinfo/winpcap-bugs

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-bugs/attachments/20090529/c434790c/attachment.htm