This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Experts, I see in your example cap (telnet-cooked.pcap), in packet number 18 the packet size in IP header is 137 Bytes, but real length of the packet is 66 Bytes. Is it O.K. or this is a mistake?

Thanks

asked 31 Aug '14, 07:09

cskovec's gravatar image

cskovec
1111
accept rate: 0%

converted to question 31 Aug '14, 07:51


That's apparently a failure, as the IP frame can't be larger than the whole frame itself (see Frame layer). If you look at frame #17, you'll notice that it's the same frame as #18 (same IP ID, all the rest identical), but this time with the correct size in the IP header.

This happens twice in the capture file (filter: ip.len > frame.cap_len), so it looks like a problem on the system where the capture file was taken.

Good spot!!

Regards
Kurt

permanent link

answered 31 Aug '14, 13:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 31 Aug '14, 13:14

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×20
×5

question asked: 31 Aug '14, 07:09

question was seen: 2,168 times

last updated: 31 Aug '14, 13:14

p​o​w​e​r​e​d by O​S​Q​A