From 980b0f7c2ecc8681b735ad5fcf928a3b62dc2f05 Mon Sep 17 00:00:00 2001 From: Sam Roberts Date: Tue, 24 Apr 2012 10:10:47 -0700 Subject: Note about ethernet padding being stripped by decode --- lua/libnet_decode.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lua/libnet_decode.c b/lua/libnet_decode.c index 996445e..125eaf2 100644 --- a/lua/libnet_decode.c +++ b/lua/libnet_decode.c @@ -137,6 +137,11 @@ int libnet_decode_ipv4(const uint8_t* pkt, size_t pkt_s, libnet_t *l) /* pcaps often contain trailing garbage after the IP packet, drop that, but not the ip hdr * no matter how damaged the ip_len field is */ + /* TODO this means its not possible to reencode pcaps... the padding that comes + off the wire for eth frames shorter than 60 bytes gets lost. However, the next-hdr + only knows its length because of what tcp tells it... maybe ipv4 should push pblock + with any trailing garbage, afterwards? But that might cause lengths to be reevaluated + unless there was a specific pblock type for ethernet-padding. */ if(pkt_s > ntohs(ip_hdr->ip_len)) pkt_s = ntohs(ip_hdr->ip_len); -- cgit v1.2.1