Packet Size Issue from Pcap File

Apr 15, 2012 at 3:33 PM

Hi Boaz,

I was surprised from what I encountered from the Pcap file (using Wireshark) it shows only 169 bytes, however when I read it using offline reader the packet length increase to 223 bytes?

// Create the offline device
var selectedDevice = new OfflinePacketDevice(pcapFile);
// Open the capture file
var communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000);

if (_packetFilter.Length > 0)
    BerkeleyPacketFilter filter = communicator.CreateFilter(_packetFilter);
communicator.ReceivePackets(0, PacketHandler);


private static void PacketHandler(Packet packet)
	var data = packet.Buffer;
	var dataLength = packet.Length;


Anything should I consider or did I missed something?


Appreciate your help in advance.







Apr 16, 2012 at 4:39 PM

Hi techguy,


Can you provide a link to the pcap file?





Apr 17, 2012 at 7:38 AM

Hi Boaz,

Sorry for late reply, I managed to find the solution after digging the documentation.

private static void PacketHandler(Packet packet)
	var ip = packet.Ethernet.IpV4;	
	Datagram tcpData = ip.Tcp.Payload;
	byte[] payload = tcpData.ToArray();
	var payloadSize = tcpData.ToArray().Length;