search

dotpcap / sharppcap

Official repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
1.33k stars 268 forks source link

CaptureFileWriterDevice.Write((RawCapture p) ignores PacketLength field #479

Open alikovvl opened 11 months ago

alikovvl commented 11 months ago

If the data buffer is larger than the packet, it will be completely saved in a pcap file. This results in a large pcap file and makes it difficult to analyze. Such buffers are obtained by using ArrayPool.Rent.

kayoub5 commented 11 months ago

got an example?

alikovvl commented 11 months ago

https://github.com/dotpcap/sharppcap/blob/b6a0533200400c6b80377067286e7c6c221d2c2b/SharpPcap/LibPcap/CaptureFileWriterDevice.cs#L202

This will happen if the buffer size is not equal to the packet size.

kayoub5 commented 11 months ago

you need to create Span<byte> with correct size from the array you rented.

alikovvl commented 11 months ago

Sharppcap.Issue479.zip