LengthWire/LengthCapture limited for a reason?

[michael-brade]

See here:

pcap2json/flow.c

Lines 1580 to 1581 in 9a58a2d

	assert(PktHeader->LengthWire < 16*1024);
	assert(PktHeader->LengthCapture < 16*1024);

This crashes when I do a live capture on my local network because I get sizes of up to 64374 bytes. So why limit it to 14 bits instead of 16?

Because packets are always less than 14bits on the physical network. your seeing larger sized packets because segment offloading is enabled on the NIC.

…

On Tue, Apr 13, 2021, 19:20 Michael Brade ***@***.***> wrote: See here: https://github.com/fmadio/pcap2json/blob/9a58a2dcfcd6b45b38eefe7e38229a146a97d83b/flow.c#L1580-L1581 This crashes when I do a live capture on my local network because I get sizes of up to 64374 bytes. So why limit it to 14 bits instead of 16? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#36>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC6RA27JAKNQYJGIO6YTHMLTIQZI5ANCNFSM423HNIWQ> .

[michael-brade]

I see. So am I not supposed to use this with segment offloading? I changed the assert and have it working... :)

correct, we use the application for running analysis on real wore traffic

…

On Tue, Apr 13, 2021, 19:48 Michael Brade ***@***.***> wrote: I see. So am I not supposed to use this with segment offloading? I changed the assert and have it working... :) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#36 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC6RA2Y6V6OLT2XI5YZJSG3TIQ4SJANCNFSM423HNIWQ> .