search

dotpcap / sharppcap

Official repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
1.28k stars 267 forks source link

IPv4 Length exceeds Packet Length during live device capture #449

Closed exp111 closed 1 year ago

exp111 commented 1 year ago

I've encountered this issue where I can't access the tcp payload data during a live recording with SharpPcap and PacketDotNet. Looked into it a bit deeper and found out that during live recording the fragmented packets have the wrong length. Attached is a pcap that I created using the CaptureFileWriterDevice as wireshark didn't produce faulty packets.

pcap.zip The packet in question: grafik Image of the packet recorded using wireshark (not the same recording): grafik

Maybe it's because I'm capturing the loopback device? Is this a bug in sharpcap or is it the driver?

Using Windows 10, SharpPcap 6.2.5, Npcap 1.72 Also tried using the CreatingCaptureFile example with the same result.

kayoub5 commented 1 year ago

increase DeviceConfiguration.Snaplen

exp111 commented 1 year ago

That fixed it, thanks