This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Total length of packets

0
1

I am capturing packets using libpcap. I am calculating the payload size as given here
size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp);
Now when I print ntohs(ip->ip_len), I see that the value is 1280. For the same packets, wireshark shows a value of 1500 for the total length field in the IP header. Why do they differ?

asked 28 Sep '12, 01:59

rony358's gravatar image

rony358
1●1●2●2
accept rate: 0%

edited 28 Sep '12, 01:59