Hi Experts, I see in your example cap (telnet-cooked.pcap), in packet number 18 the packet size in IP header is 137 Bytes, but real length of the packet is 66 Bytes. Is it O.K. or this is a mistake? Thanks asked 31 Aug '14, 07:09  cskovec converted to question 31 Aug '14, 07:51 |
One Answer:
That's apparently a failure, as the IP frame can't be larger than the whole frame itself (see Frame layer). If you look at frame #17, you'll notice that it's the same frame as #18 (same IP ID, all the rest identical), but this time with the correct size in the IP header. This happens twice in the capture file (filter: ip.len > frame.cap_len), so it looks like a problem on the system where the capture file was taken. Good spot!! Regards answered 31 Aug '14, 13:13  Kurt Knochner ♦ edited 31 Aug '14, 13:14 |
