Date: Thu, 11 Jul 1996 08:05:03 PDT From: Bill Fenner <fenner@parc.xerox.com> To: Rick Weldon <rick@wisetech.com> Cc: freebsd-hackers@freebsd.org Subject: Re: BPF implementation questions Message-ID: <96Jul11.080508pdt.177476@crevenia.parc.xerox.com> In-Reply-To: Your message of "Fri, 28 Jun 96 19:11:06 PDT." <31D490BA.446B9B3D@wisetech.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <31D490BA.446B9B3D@wisetech.com> you write: >The bpf_hdr is lying to me on >exactly how much TCP data is there in a round about sort of way. No, it's not. It's telling you the length of the packet that it captured off the network. Since Ethernet has a minimum packet length, short packets need to be padded by the sender, and the two extra bytes that you're seeing are padding added by the host that sent the packet. You need to look at the IP length field (0x002c in your example packet, which points at the end of the TCP header) to find the end of the TCP packet. Bill
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?96Jul11.080508pdt.177476>