This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

The libpcap packet header structure has 2 length fields:

typedef struct pcaprec_hdr_s {
        guint32 ts_sec;         /* timestamp seconds */
        guint32 ts_usec;        /* timestamp microseconds */
        guint32 incl_len;       /* number of octets of packet saved in file */
        guint32 orig_len;       /* actual length of packet */
} pcaprec_hdr_t;

incl_len: the number of bytes of packet data actually captured and saved in the file. This value should never become larger than orig_len or the snaplen value of the global header.

orig_len: the length of the packet as it appeared on the network when it was captured. If incl_len and orig_len differ, the actually saved packet size was limited by snaplen.

Can any one tell me what is the difference between the 2 length fields? We are saving the packet in entirely then how can the 2 differ?

asked 07 Mar '12, 21:17

v%20j's gravatar image

v j
11447
accept rate: 0%


If you are capturing the entire packet they do not differ, but if yo have specified that only 96 bytes of each packet should be saved(snap lenght) then incl_lenght will be 96 and orig_len the actual lenght of the packets which makes it possible for a program reading the file to "know" that bytes are "missing".

permanent link

answered 07 Mar '12, 21:58

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

I am trying to capture TinyOS (telosb mote) packets in wireshark. Wireshark doesnt support direct capture from telosb motes so i am writing a application that fetches the packets and writes to a capture file in pcap format. The problem is the received packets are in TINYOS format so I need to create a 802.15.4 packet from it. I have used the structure Ieee802154_packet (from wirshark) to create the packet and write to the file. Here incl/cap len should be the size of Ieee802154_packet struct? Please correct me if I am wrong.

(07 Mar '12, 22:21) v j
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×40
×37

question asked: 07 Mar '12, 21:17

question was seen: 2,702 times

last updated: 07 Mar '12, 22:21

p​o​w​e​r​e​d by O​S​Q​A