-
Notifications
You must be signed in to change notification settings - Fork 41
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
calculate TCP payload slice sizes for Ethernet II packets less than 64 octets #326
Conversation
Maybe we just should ignore runt packets? Anyway they are caused by collisions and bugs. |
I guess it depends on what the shortest http request can be and the size
|
I don't think these are technically runt frames as runts are < 64 bytes and these are properly formed, just padded. So I think my jargon was incorrect. |
I'll update the issues to say dealing with padded frames instead of runts. |
I'm unsure if we can really drop padded frames because they could be a fragmented request right? It's quite an edge case but we could have real data instead of just padding. Ethernet II frames have a minimum size of 64 octets where 4 octets are CRC Checksum so only 60 octets are valid data. A TCP/IP communication over Ethernet takes 54 bytes (calculator) which leaves 6 bytes for data. The smallest HTTP request is 20 bytes:
But we could get a case where the request is fragmented so a request could be part of a padded payload. |
When dealing with |
Right so that could have a size of 59 bytes with one padded zero. |
BTW for those that read this in the future, we are using bytes and octets interchangeably. So for our conversation 1 byte = 8 bits = 1 octet. https://en.wikipedia.org/wiki/Octet_(computing) |
@@ -397,7 +397,12 @@ func (t *Listener) readPcap() { | |||
|
|||
srcIP = data[12:16] | |||
dstIP = data[16:20] | |||
data = data[ihl*4:] | |||
if len(packet.Data()) < 64 && decoder == layers.LinkTypeEthernet { // beware the runt frame https://en.wikipedia.org/wiki/Ethernet_frame#Runt_frames | |||
sliceLen := len(packet.Data()) - (len(packet.Data()) - int(binary.BigEndian.Uint16(data[2:4])) - of) - of |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm right that the formula above can be simplified to: int(binary.BigEndian.Uint16(data[2:4]))
?:)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah I think you are right. I'll trim that down.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So we are trying to calculate the actual end of the data packet (E) that is in a padded envelope minus the header. IL is IP Envelope length. So
E = IL + pad
IL = E - pad
So data = data[ihl * 4: int(binary.BigEndian.Uint16(data[2:4]))]
I still can't find information about padded frames which are valid, only about runt ones, which can be safely ignored. |
How about here https://www.ietf.org/rfc/rfc1042.txt
|
sometimes I think the padding is implied by the minimum length. |
Okay padding is part of IEEE 802.3 standard and here are the relevant citations. Section 3 is Media Access Control (MAC) frame and packet specifications for the standard.
next up 3.2.6:
and
|
feel free the squash |
Thank you for the detailed PR! |
Calculate TCP payload slice sizes for Ethernet II packets less than 64 octets and fix #325.