0

I'm using a pcap.net process to broadcast out a packet, and listen in for a response. I want the response packets that it accepts to be a certain length. However, whenever I add a filter it only returns packets of length 100. Here's the code: 

' Open the output device
Dim Communicator As PacketCommunicator = selectedOutputDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 300)

Communicator.SetFilter("len >= 300")

' send broadcast packet
Communicator.SendPacket(BuildEthernetPacket(ReqInfoPkt, "ff:ff:ff:ff:ff:ff"))

' receive packets 
While result = PacketCommunicatorReceiveResult.Ok And packetlist.Count < 500 And _
    Not result = PacketCommunicatorReceiveResult.Timeout

    result = Communicator.ReceivePacket(packet)
    packetlist.Add(packet)
End While

Here's a link to the screen shot: link I tried asking on the pcap forums but didn't get a response.

So what am I doing wrong? Is there a synatx issue?

Morten Kristensen
  • 7,412
  • 4
  • 32
  • 52
Kat
  • 2,460
  • 2
  • 36
  • 70

1 Answers1

0

You open the device with the snapshot length set to 100 which means you cut all packets to be at most 100 bytes.

You should probably do

selectedOutputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 300)

instead.

See the tutorial.

brickner
  • 6,595
  • 3
  • 41
  • 54
  • If that is true, then how come when I have it set to 100 and no filter, I still get packets over 100 length? – Kat Aug 01 '14 at 13:43
  • Can you give some pcap files as examples for that? – brickner Aug 02 '14 at 10:41
  • Again, I don't understand what format you mean by pcap files, but here is a screenshot with a breakpoint of my list(of packets) with a 222 packet length. [ScreenShot1](http://postimg.org/image/e4i3itwux/) and one with 416 size packets. [screenshot2](http://postimg.org/image/ns1u2wqfj/) – Kat Aug 04 '14 at 13:22
  • From this url: http://www.winpcap.org/pipermail/winpcap-users/2008-September/002766.html what I understand is that if you don't specify a filter, the packet is not truncated. You can use Wireshark to save and read pcap files. You can also read and save pcap files using Pcap.Net. – brickner Aug 14 '14 at 20:08