Dear Chang,<br>Yes I got a packet only have 1516 bytes, so I must join 2 pakets to get the all message,<br>So in this case if the message is too long there will be more and more pakets, <br>how do I know which pakets is from a message to join it together!<br>
<br>P/S: I'm reading your link, it's very helpful, but I still not know how to resolve the problem.<br>Regard, <br>Tran Bach Thanh.<br><br><br><div class="gmail_quote">On Fri, Jul 24, 2009 at 10:09 AM, David Chang <span dir="ltr"><<a href="mailto:dchang@fsautomation.com">dchang@fsautomation.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff">
<div><font size="2" face="Arial">Tran,</font></div>
<div><font size="2" face="Arial"></font> </div>
<div><font size="2" face="Arial">Standard TDS headers are 4 bytes long. The
first byte is the 'packet type'. The second byte is the 'last packet
indicator'. The next two bytes are the 'packet size'. Thus, in your
case, you should have gotten a 'packet size' that was greater than one Ethernet
packet length (around 1500 bytes).</font></div>
<div><font size="2" face="Arial"></font> </div>
<div><font size="2" face="Arial">I suggest you look at: <a href="http://www.freetds.org/tds.html" target="_blank">http://www.freetds.org/tds.html</a></font></div>
<div><font size="2" face="Arial"></font> </div><font color="#888888">
<div><font size="2" face="Arial">DC</font></div>
</font><blockquote style="border-left: 2px solid rgb(0, 0, 0); padding-right: 0px; padding-left: 5px; margin-left: 5px; margin-right: 0px;"><div class="im">
<div style="font-family: arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;">----- Original Message ----- </div>
<div style="background: rgb(228, 228, 228) none repeat scroll 0% 0%; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial; font-family: arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;">
<b>From:</b>
<a title="xbachngoctuyetx@gmail.com" href="mailto:xbachngoctuyetx@gmail.com" target="_blank">tran thanh</a> </div>
<div style="font-family: arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"><b>To:</b> <a title="winpcap-users@winpcap.org" href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a> </div>
</div><div><div></div><div class="h5"><div style="font-family: arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;">
<b>Sent:</b> Thursday, July 23, 2009 7:31
PM</div>
<div style="font-family: arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"><b>Subject:</b> Re: [Winpcap-users] Size of
packet captured!</div>
<div><br></div>Dear Varenni and Chang,<br>Firstly thanks for your help,<br>I'm
using TCP!<br>I got Full TDS message from 2 packets, <br>But new matter is how
do I know that 2(or more) pakets is from a TDS message?<br>Thanks,<br>Tran
Bach Thanh!<br><br><br>
</div></div><div class="im"><p>
</p><hr>
<p></p>_______________________________________________<br>Winpcap-users
mailing list<br><a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br><a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
</div></blockquote></div>
<br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></blockquote></div><br>