<br><br>
<div><span class="gmail_quote">On 9/29/05, <b class="gmail_sendername">Abdul Qayum</b> <<a href="mailto:abdulqayum@gmail.com">abdulqayum@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div>Dear Sir,</div>
<div>i checked it with Ethereal . Its same Ethereal send two request and receive one reply.</div>
<div> </div>
<div>But i designed a simple application which monitor traffic on a given ip and draw graph w.r.t time for both side traffic. Traffic coming from that IP address and Taffic moving toward that IP address. </div>
<div> </div>
<div>Its work by getting the length of packet from pcap_pkthdr *header and obviously filtering mentioned ip address. its string for filter is char packet_filter[] = "ip";</div>
<div> </div>
<div>My application work fine as longs as data size is under the limit of MTU i.e less than 1500-hearder.</div>
<div>It shows same length of data coming and going out.</div>
<div> </div>
<div>But as packet size increase from 1500 byte( Fragmentation start ). Sending taffic shown greater than received traffic. </div>
<div> </div>
<div>As size increases difference of total data send and receive increases. Interesting thing is that difference maintain same. </div>
<div> </div>
<div> </div>
<div>Note: I generated traffic using ping and size change using l switch. and i use function f pcap_next_ex( adhandle, &header, &pkt_data) for capturing traffic.</div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div>Pls help me to rectify this issue. </div>
<div><span class="e" id="q_106a20678ef47e5b_1">
<div> </div>
<div> </div>
<div> </div>
<div><br><br> </div>
<div><span class="gmail_quote">On 9/28/05, <b class="gmail_sendername">Loris Degioanni</b> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:loris.degioanni@gmail.com" target="_blank">loris.degioanni@gmail.com
</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">What is the output of WinDump or Ethereal with the same traffic?<br><br>Loris<br><br><br>Abdul Qayum wrote:
<br>> Hello Everybody<br>> I have confusion about traffic capture by example program given in winpcap<br>> tutorial. I copied the program and compile it. I am using Winpcap<br>> 3.1original version<br>><br>
> To simulate Traffic i just use ping command to send 50 byte at its reqular<br>> interval<br>><br>> ping <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.56.18.1/" target="_blank">10.56.18.1
</a> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.56.18.1/" target="_blank">http://10.56.18.1</a>> -t -l 50 <br>><br>> The output shows that<br>><br>> two packet send contineously by sender
<br>> but only one packet received from receiver<br>> and this pattern is contineous<br>><br>> But in Ping command as many packet send , same should be received. It <br>> was not case in output on screen. I used DU
<br>> meter ( bandwidth software <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dumeter.com/" target="_blank">www.dumeter.com</a> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dumeter.com/" target="_blank">
http://www.dumeter.com/</a>> <<br>> <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dumeter.com/" target="_blank">http://www.dumeter.com</a> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.dumeter.com/" target="_blank">
http://www.dumeter.com/</a>>> ) for<br>> comparison its give me exact result but packer capturing routine giving me <br>> differnet result.<br>><br>> It shows onne packet received against two packet send. its shown below
<br>> If someone could help me. I will be greatful<br>><br>> Muhammad Abdul Qayum<br>> Reslut of capturing packet programe. <br>> 1:17:17.727451 len:92 10.56.18.24.8 -> 10.56.18.1.29261<br>> 1:17:17.727486
len:92 10.56.18.24.8 -> 10.56.18.1.29261<br>> 1:17:17.728696 len:92 10.56.18.1.0 -> 10.56.18.24.29269<br>><br>> 1:17: 18.733117 len:92 10.56.18.24.8 -> 10.56.18.1.29260<br>> 1:17:18.733125 len:92 10.56.18.24.8
-> 10.56.18.1.29260<br>> 1:17:18.733127 len:92 10.56.18.1.0 -> 10.56.18.24.29268<br>><br>> 1:17:19.730743 len:92 10.56.18.24.8 -> 10.56.18.1.29259<br>> 1:17:19.730776 len:92 10.56.18.24.8 -> 10.56.18.1.29259
<br>> 1:17:19.731981 len:92 10.56.18.1.0 -> 10.56.18.24.29267<br>><br>> 1:17:20.736450 len:92 10.56.18.24.8 -> 10.56.18.1.29258<br>> 1:17:20.736457 len:92 10.56.18.24.8 ->10.56.18.1.29258<br>> 1:17:
20.736459 len:92 10.56.18.1.0 -> 10.56.18.24.29266<br>><br>> 1:17:21.734230 len:92 10.56.18.24.8 -> 10.56.18.1.29257 <br>> 1:17:21.734263 len:92 10.56.18.24.8 -> 10.56.18.1.29257<br>> 1:17:21.735244 len:92
10.56.18.1.0 -> 10.56.18.24.29265<br>><br>> 1:17:22.736412 len:92 10.56.18.24.8 -> 10.56.18.1.29256<br>> 1:17: 22.736447 len:92 10.56.18.24.8 -> 10.56.18.1.29256<br>> 1:17:22.737467 len:92 10.56.18.1.0
-> 10.56.18.24.29264<br>><br>> 1:17:23.743066 len:92 10.56.18.24.8 -> 10.56.18.1.29255<br>> 1:17:23.743072 len:92 10.56.18.24.8 -> 10.56.18.1.29255<br>> 1:17:23.743074 len:92 10.56.18.1.0 -> 10.56.18.24.29263
<br>><br>><br>> Pls guide<br>><br>><br>> Thanking you<br>><br>> Muhammad Abdul Qayum<br>><br>><br>><br>><br>> ------------------------------------------------------------------------
<br>><br>> _______________________________________________<br>> Winpcap-users mailing list<br>> <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:Winpcap-users@winpcap.org" target="_blank">
Winpcap-users@winpcap.org</a><br>> <a onclick="return top.js.OpenExtLink(window,event,this)" href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users
</a><br></blockquote></div><br></span></div></blockquote></div><br>