[Winpcap-users] problem with pcap_packetsend

[Bryan Kadzban]

On Thu, Nov 02, 2006 at 01:14:42AM +0800, Horatio wrote:
> Gianluca Varenni,
> 
> I think you are right. Thank you very much.
> I forgot the limit of Ethernet frame size......I'm such an idiot!
> 
> The computer in private network sends a frame with 1514bytes (sent by
> MSN Messenger, a TCP segment of a reassembled PDU),
> and then I add the PPPoE/PPP header. Now the frame is 1522bytes.
> 
> But the MSN Messenger on the computer which directly access Internet on
> PPPoE, that frame is 1502bytes including PPPoE/PPP header.
> MSN is so smart to detect it and adjust the frame size!? How did it do this?

No, it's not that MSN messenger is that smart.  It's that the OS TCP/IP
stack is that smart.

Ethernet devices have a maximum data size of 1500.  The IP layer knows
this limit, and sets the IP MTU to (1500 - IPheadersize).  The TCP layer
likewise knows IP's MTU, and sets its MSS to (MTU - TCPheadersize).

So in the end, TCP will never generate a segment whose total size is
larger than the Ethernet layer's maximum.  (Well, excluding extra IP
header options.  But those are rare.)  If the TCP stream is larger than
the MSS, it gets segmented.  If the IP packet data count is larger than
the MTU, the IP packets get fragmented.  If the Ethernet frame tries to
transmit more data than it's able to, you get an error.

Anyway, the fix would be to lower the MTU on your virtual interface.  Or
be prepared to handle IP fragmentation.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: not available
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20061101/79edfca2/attachment.pgp