[Winpcap-users] RE: first ethernet pkt gobbled by the nextone...solved

Har Yash Bahadur har.bahadur at conexant.com
Tue Apr 8 11:56:55 GMT 2008

Hi Pedro,

So you mean that specifying the parameter 'size'=1518 was incorrect in pcap_sendpacket?

An excerpt from WinPcap documentation is as follows:
int pcap_sendpacket  ( pcap_t *  p,
  u_char *  buf,
  int  size

Send a raw packet.

This function allows sending a raw packet to the network. p is the interface that will be used to send the packet, buf contains the data of the packet to send (including the various protocol headers), size is the dimension of the buffer pointed by buf, i.e. the size of the packet to send. >>>>The MAC CRC doesn't need to be included, because it is transparently calculated and added by the network interface driver<<<<. The return value is 0 if the packet is succesfully sent, -1 otherwise.

It seems that 4 byte CRC which is added by WinPcap or the NIC makes the total pkt to be 1518 bytes, and that restricts payload size to 1500 bytes.

1518 - 4 - 14 = 1500.

I observed the same thing during reception of pkts. When the device sends pkts with payload size <= 1500, they are received properly; but if payload size is 1504 bytes (=> total size=1504+4+14=1518 bytes) then the pkt is dropped -- does not show up on ethereal as well.

Har Yash


-----Original Message-----
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Pedro Lucas
Sent: Tuesday, April 08, 2008 2:34 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] RE: first ethernet pkt gobbled by the nextone...solved

It's not a standard sized frame per se, it's the maximum sized frame for
transmission within IEEE 802.3. going beyond this limit would kill the
compatibility with other standards like oldie Token Ring and newer 802.11.
There's a an addenda to the standard to allow 1522 to include the VLAN tag
but that's it.
Several equipments allow oversized or jumbo frames, namely test equipments
from Spirentcom, IXIA, using Gigabit adapters.
That depends on the network adapter and driver. If you're going to attempt
it using a vanilla FastEther card, it won't work.
But Winpcap should be able to cope with it, at least I dont remember looking
at frame limiting code inside.

----- Original Message -----
From: "Har Yash Bahadur" <har.bahadur at conexant.com>
To: "Har Yash Bahadur" <har.bahadur at conexant.com>;
<winpcap-users at winpcap.org>
Sent: Tuesday, April 08, 2008 8:59 AM
Subject: [Winpcap-users] RE: first ethernet pkt gobbled by the

> Hi All,
> I found that WinPcap is not able to send or receive Ethernet packets of
> size >1514 bytes (inclusive of 14 byte MAC header). The packet lost was of
> 1518 bytes which is the standard size in case of Ethernet packets. It
> means the payload cannot be more than 1500 (=1514 - 14) bytes.
> I tried the same thing while sending a packet and I got an error from
> function "pcap_sendpacket". When I reduced the total size to 1514 it works
> fine!
> Anybody has any idea why this LIMIT? Ahs anybody else faced this issue?
> Regards,
> Har Yash

Winpcap-users mailing list
Winpcap-users at winpcap.org

Conexant E-mail Firewall (Conexant.Com) made the following annotations
********************** Legal Disclaimer **************************** 

"This email may contain confidential and privileged material for the sole use of the intended recipient. Any unauthorized review, use or distribution by others is strictly prohibited. If you have received the message in error, please advise the sender by reply email and delete the message. Thank you." 



More information about the Winpcap-users mailing list