packet truncation

48 views
Skip to first unread message

datasto...@gmail.com

unread,
Oct 7, 2019, 10:41:07 AM10/7/19
to Pcap.Net Q&A
Hi everyone,
I'm try to receive data from a network device who communicate via network interface.
This is my code of receiving data:

           using (PacketCommunicator communicator = selectedDevice.Open(   65536,  
                                                                           
PacketDeviceOpenAttributes.Promiscuous,
                                                                           
1000))
           
{
               
               
// Check the link layer. We support only Ethernet for simplicity.
               
if (communicator.DataLink.Kind != DataLinkKind.Ethernet)
               
{
                   
MessageBox.Show("This program works only on Ethernet networks.");
                   
return;
               
}


               
string strFilter = "src host 192.168.3.67";
               
// Compile the filter
               
using (BerkeleyPacketFilter filter = communicator.CreateFilter(strFilter))
               
{
                   
// Set the filter
                    communicator
.SetFilter(filter);
               
}
               
               
while (true)
               
{
                   
try
                   
{
                       
// Read and dispatch packets until EOF is reached
                        communicator
.ReceivePackets(0, DispatcherHandler);
                   
}
                   
catch (Exception ex)
                   
{
                        _Parent
.Log.LogError(ex.Message);
                       
continue;
                   
}
               
}
           
}

This is my callback function:

 
      private void DispatcherHandler(Packet packet)
       
{
               
// Create two different encodings.
               
Encoding ascii = Encoding.ASCII;
               
Encoding unicode = Encoding.Unicode;

               
//Converto il pacchetto in formato UNICODE
               
string unicodeString = Encoding.UTF8.GetString(packet.Buffer, 0, packet.Length);
               
// Convert the string into a byte array.
               
byte[] unicodeBytes = unicode.GetBytes(unicodeString);
               
// Perform the conversion from one encoding to the other.
               
byte[] asciiBytes = Encoding.Convert(unicode, ascii, unicodeBytes);
               
// Convert the new byte[] into a char[] and then into a string.
               
char[] asciiChars = new char[ascii.GetCharCount(asciiBytes, 0, asciiBytes.Length)];
                ascii
.GetChars(asciiBytes, 0, asciiBytes.Length, asciiChars, 0);
               
string asciiString = new string(asciiChars);

[...]

//asciiString is truncate!!




Normally (if I get from the device short ansewer) the program works but when the device send long packet I have a truncation (1514 car truncation int the packet).
Wireshark instead retrive full packets.
I search in the documentation, in the Q&A and I don't find similar problem. 
Also I've try to:
-increase the snapshotlenght in the Open comunicator call
-increase the read timeout in the Open comunicator call
-change the communicator.SetKernelBufferSize.

Any ideas?


datasto...@gmail.com

unread,
Oct 8, 2019, 4:35:57 AM10/8/19
to Pcap.Net Q&A
Ok, I've resolved.
The problem is the fragmentation of the packet.
I've do a reassembly of sequential packet only in case of fragmentation.


Reply all
Reply to author
Forward
0 new messages