search

fmadio / pcap2json

High Speed PCAP to JSON conversion utility
Other
99 stars 22 forks source link

LengthWire/LengthCapture limited for a reason? #36

Open michael-brade opened 3 years ago

michael-brade commented 3 years ago

See here: https://github.com/fmadio/pcap2json/blob/9a58a2dcfcd6b45b38eefe7e38229a146a97d83b/flow.c#L1580-L1581

This crashes when I do a live capture on my local network because I get sizes of up to 64374 bytes. So why limit it to 14 bits instead of 16?

fmadio commented 3 years ago

Because packets are always less than 14bits on the physical network. your seeing larger sized packets because segment offloading is enabled on the NIC.

On Tue, Apr 13, 2021, 19:20 Michael Brade @.***> wrote:

See here: https://github.com/fmadio/pcap2json/blob/9a58a2dcfcd6b45b38eefe7e38229a146a97d83b/flow.c#L1580-L1581

This crashes when I do a live capture on my local network because I get sizes of up to 64374 bytes. So why limit it to 14 bits instead of 16?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/fmadio/pcap2json/issues/36, or unsubscribe https://github.com/notifications/unsubscribe-auth/AC6RA27JAKNQYJGIO6YTHMLTIQZI5ANCNFSM423HNIWQ .

michael-brade commented 3 years ago

I see. So am I not supposed to use this with segment offloading? I changed the assert and have it working... :)

fmadio commented 3 years ago

correct, we use the application for running analysis on real wore traffic

On Tue, Apr 13, 2021, 19:48 Michael Brade @.***> wrote:

I see. So am I not supposed to use this with segment offloading? I changed the assert and have it working... :)

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/fmadio/pcap2json/issues/36#issuecomment-818708267, or unsubscribe https://github.com/notifications/unsubscribe-auth/AC6RA2Y6V6OLT2XI5YZJSG3TIQ4SJANCNFSM423HNIWQ .