1576 bytes on wire, 790 bytes captured!

retag add tags

I have written a small program which sends 758 bytes to a UDP port. Wireshark reports that the data part of the packet is indeed 758 bytes and the whole packet is 790 bytes, so far so good, but, it's also reporting 1576 bytes on the wire (and the receiving app doesn't like the packet). I figured it must be something in my code, however, it seems fine on other PCs, so it's something wrong with this particular PC running Window 7.

Any ideas what might be the cause?

weird_dave

asked 2019-03-19 11:19:38 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Any chance of a link to the capture so we can look at it ourselves rather than guessing?

grahamb (2019-03-19 11:28:56 +0000) edit

https://www.dropbox.com/s/6t4wk1v5kve...

I now suspect this is the cause: http://packetbomb.com/how-can-the-pac...

weird_dave (2019-03-19 15:23:47 +0000) edit

I think this is more an npcap\loopback artefact.

grahamb (2019-03-19 15:58:11 +0000) edit

I'm inclined to agree.

weird_dave (2019-03-19 16:08:48 +0000) edit

add a comment see more comments

Comments

FWIW, I see the same., I didn't see an existing issue for this.

grahamb (2019-03-19 22:38:27 +0000) edit

I created nmap issue 1524 for this.

grahamb (2019-03-19 22:50:35 +0000) edit

Awesome! Thanks :)

weird_dave (2019-03-20 09:21:19 +0000) edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

1576 bytes on wire, 790 bytes captured! edit

Comments

1 Answer

Comments