Menu

#44 Packet.Net Appears to use 'bytes on wire' and not 'bytes captured'

v1.0_(example)
open
nobody
None
1
2014-12-28
2012-10-03
Anonymous
No

While trying to parse HTTP information from an instance of TcpPacket via the Bytes[] I received a large amount of junk data after the correct "GET /path/etc" information. Upon investigation the Bytes[].GetLength(0) gives the TCP payload length on the wire, not the captured length. Validated this with Wireshark by looking at the bytes on wire and bytes captured fields for the packet in question. Guessing that an uninitialized string of length 'bytes on wire' has 'bytes captured' written into the beginning leaving junk in the end.

Suggest initializing arrays and using correct 'bytes captured' to dimension arrays.

Problem encountered processing an offline capture of trauncated packets (where cap length is frequently less than length on wire).

Discussion

Anonymous
Anonymous

Add attachments
Cancel