Re: Getting mbuf length
Re: Getting mbuf length
- Subject: Re: Getting mbuf length
- From: Vincent Lubet <email@hidden>
- Date: Wed, 19 Nov 2008 10:55:44 -0800
On Nov 19, 2008, at 8:13 AM, Mitchell Laurren-Ring wrote:
How do you know that you are not seeing the entire IP packet when
you copy the mbuf? Is the more fragments flag set in the IP header?
Wireshark tells me that the packet is broken into two pieces. This
particular packet is an HTTP request. I need to find the "Host:"
part near the end and it doesn't show up in the first half of the
packet.
Is the more fragments flag in the ip_off field?
Yes, it is.
I think you will find there is no IP fragmentation but rather that the
HTTP request is simply too big to fit is a single IP packet. Remember
that the job of IP protocol is to packetize higher level protocol like
UDP, TCP, HTTP, FTP and so on. An IP filter that wants to parse
application level protocols like HTTP needs to be prepared to deal
with all the protocol details of IP, TCP and HTTP.
Vincent
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden