libpcap and ip_len

["Allison, Jason (JALLISON)" <JALLISON () arinc com>]

Sorry for the simple question.

I am having some trouble (I think) accessing the ip_len value in the ip
header.

I am monitoring ftp transfers on 10 Ethernet and these are my results (x86
RH8):

printf("%d %d\n", iphdr->ip_len, (int)ntohs(iphdr->ip_len));

Output:
10240 40

Is fragmentation skewing the length in bytes?  I know the max size of an IP
datagram is 65535, but Ethernet is 1500.  Is it that the packet is already
pieced back together by the time my app gets to it?  Or are each of these
ftp packets 40 bytes?

When I tally the transfer 10240 is the only 'possibility' but my numbers
dont correspond to the values shown from the FTP output.

Thanks,

Jason

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe