yeah that was it- I was opening pcap_live with MIN_PACKET_SIZE rather than
WTAP_MAX_PACKET_SIZE
thanks- i caught that in like 2 seconds after reading your response.
-N
At 05:43 PM 11/23/2003 -0800, you wrote:
On Sun, Nov 23, 2003 at 07:12:46PM -0500, Nate Lally wrote:
> is there something that would cause a size misreport on a 32 byte icmp
> echo request using the following code?
>
> hfinfo = proto_registrar_get_byname("data");
> if (hfinfo != NULL) {
> finfos = proto_get_finfo_ptr_array(edt->tree, hfinfo->id);
> if (finfos && (g_ptr_array_len(finfos) != 0)) {
> finfo = g_ptr_array_index(finfos, 0);
> data = tvb_get_ptr(finfo->ds_tvb, finfo->start, finfo->length);
> data_s = finfo->length;
> fprintf(stderr, "size %d start %d\n", data_s, finfo->start);
> } else {
> fprintf(stderr, "no finfo for %s\n", hfinfo->abbrev);
> }
> }
>
> i am working on a packet generation framework and i am trying to place the
> contents of icmp data into a buffer
> yet it cuts off the last 6 bytes for some reason- on a 74 byte packet-
> tvb_length reports 68.
If 68 is the length of the top-level tvbuff for the link-layer frame,
that could just be the result of the link-layer frame being cut off at
68 bytes by, for example, tcpdump's default snapshot length of 68.
"ds_tvb" would, for a non-reassembled packet, be the top-level tvbuff.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
