search

aregm / nff-go

NFF-Go -Network Function Framework for GO (former YANFF)
BSD 3-Clause "New" or "Revised" License
1.38k stars 156 forks source link

packet.GetPacketLen() mismatchs the packet length in pcap file ? #693

Closed cang233 closed 4 years ago

cang233 commented 4 years ago

I save the pcaket len using the code:

                p := &flows.Ipv4TCPPktInfo{
                    EtherHdr:    *ps[i].Ether,
                    Ipv4Hdr:     *ps[i].GetIPv4NoCheck(),
                    TCPHdr:      *tcp4,
                    TotalLen:    ps[i].GetPacketLen(),
                    ArrivalTime: ps[i].GetPacketTimestamp(),
                }

and I save the struct with json :

    "pkts": [{
            "arrival_time": 0,
            "total_len": 66
        }, {
            "arrival_time": 0,
            "total_len": 60
        }, {
            "arrival_time": 0,
            "total_len": 262
        }, {
            "arrival_time": 0,
            "total_len": 60
        }, {
            "arrival_time": 0,
            "total_len": 147
        }, {
            "arrival_time": 0,
            "total_len": 1414
        }, {
            "arrival_time": 0,
            "tcp_header": {
                "Cksum": 35955,
                "DataOff": 80,
                "DstPort": 47873,
                "RecvAck": 549318850,
                "RxWin": 260,
                "SentSeq": 974496580,
                "SrcPort": 48098,
                "TCPFlags": 24,
                "TCPUrp": 0
            },
            "total_len": 1105
        },
        ...

However,I found the packet lengths showed in pcap file are different from those in the json file. image

the SrcPort 47873 is Host Order,I transfer it into Byte Order is 443，which are all match the pcap file's. Any mistake I make?