This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Packet size in telnet-cooked .pcap example

0

Hi Experts, I see in your example cap (telnet-cooked.pcap), in packet number 18 the packet size in IP header is 137 Bytes, but real length of the packet is 66 Bytes. Is it O.K. or this is a mistake?

Thanks

asked 31 Aug '14, 07:09

cskovec's gravatar image

cskovec
1111
accept rate: 0%

converted to question 31 Aug '14, 07:51


One Answer:

0

That's apparently a failure, as the IP frame can't be larger than the whole frame itself (see Frame layer). If you look at frame #17, you'll notice that it's the same frame as #18 (same IP ID, all the rest identical), but this time with the correct size in the IP header.

This happens twice in the capture file (filter: ip.len > frame.cap_len), so it looks like a problem on the system where the capture file was taken.

Good spot!!

Regards
Kurt

answered 31 Aug '14, 13:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 31 Aug '14, 13:14