Packet Size Issue from Pcap File

Apr 15, 2012 at 3:33 PM

Hi Boaz,

I was surprised from what I encountered from the Pcap file (using Wireshark) it shows only 169 bytes, however when I read it using offline reader the packet length increase to 223 bytes?

// Create the offline device
var selectedDevice = new OfflinePacketDevice(pcapFile);
// Open the capture file
var communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000);

if (_packetFilter.Length > 0)
{
    BerkeleyPacketFilter filter = communicator.CreateFilter(_packetFilter);
        communicator.SetFilter(filter);   
}
communicator.ReceivePackets(0, PacketHandler);

 

private static void PacketHandler(Packet packet)
{
	var data = packet.Buffer;
	var dataLength = packet.Length;
}

 

Anything should I consider or did I missed something?

 

Appreciate your help in advance.

techguy

 

 

 

 

 

Coordinator
Apr 16, 2012 at 4:39 PM

Hi techguy,

 

Can you provide a link to the pcap file?

 

Thanks,

 

Boaz.

Apr 17, 2012 at 7:38 AM

Hi Boaz,

Sorry for late reply, I managed to find the solution after digging the documentation.

private static void PacketHandler(Packet packet)
{
	var ip = packet.Ethernet.IpV4;	
	Datagram tcpData = ip.Tcp.Payload;
	byte[] payload = tcpData.ToArray();
	var payloadSize = tcpData.ToArray().Length;
}

 

Cheers!

techguy