[Winpcap-users] Problem with automatic modification of
the length/type field of mac frames
guy at alum.mit.edu
Mon Jul 31 09:12:04 GMT 2006
Eduardo Escudero Sánchez wrote:
> So then as far as i have understand is the operative system the one who
> is modifying me the length field.
It might be doing that. It might happen in the driver for the network
adapter, for example.
> I pass to PacketInitPacket the length
> of all the MAC frame wgich includes: header with the source and
> destination addresses(12 bytes), length /type field which are two bytes,
> the data which i want to send (suppose three bytes) and the pad (43
Don't do that.
Pass it the length of an *UNPADDED* MAC frame, which includes: header
with the source and destination addresses (12 bytes), length/type field
which are two bytes, and the data you want to send (3 bytes, for
example), but *NOT* the pad.
> In the length / type field i put a value of three (which is the
> length of the data) but i pass to packetsendpacket a length value of 60
> (the length of all the frame);
> If i have understand you you are saying me the i must not put the pad by
> myself, i must put only the data and then the operative system will put
> the pad for me. I already have done that.
> But when the frame is received
> in the other side its received also without pad.
I.e., you've written code that sends an 802.3 frame with 3 bytes of
data, and passes to PacketInitPacket() a length of 12+2+3 = 17, and the
packet, when received by the other side, doesn't include any padding,
*and if you capture on some third machine on the network, other than the
machine sending the packet or the machine receiving the packet* (using,
for example, a port on a hub, or a mirrored port on a switch), the
packet on the network has only 17 bytes in it?
Or do you just mean that the software on the *receiving* machine gets a
packet with only 17 bytes of data (not just a packet with a length field
of 5, but a packet with only 17 bytes of data)?
(I.e, you've *actually tried sending the frame without any padding, and
it arrives without padding*? You're not just saying that *will* happen,
which isn't necessarily the case - it might not happen, if the padding
is added by, for example, the driver for the network adapter.)
More information about the Winpcap-users