[Winpcap-users] Partial packet after pcap_next_ex()
guy at alum.mit.edu
Thu Feb 12 18:15:40 GMT 2009
On Feb 12, 2009, at 10:05 AM, Jacek Jablonski wrote:
> Then I read packets using pcap_next_ex(). The problem is that the
> packet contain some text. I am trying to capture it, but only some
> part of it is being captured, then there is a garbage. After next
> pcap_next_ex() there is just the rest of this text. What is wrong? In
> linux I can read whole text using the same code. Please help.
Are these packets TCP segments?
If so, there is no guarantee that a given message - for example, an
HTTP or FTP or SMTP request or response - won't be split across
multiple TCP segments, so that some of the text will be in one packet
and more of the text will be in another packet, not even on Linux.
Whether the sending system splits the packet between TCP segments
could depend on the network you're running over and the TCP
implementations of the sending and receiving machines, including
whether the receiving machine (if you're running your application on
that machine) is doing TCP segmentation offloading.
In addition, are you checking the length of the packet?
More information about the Winpcap-users