HokakuCafe
HokakuCafe copied to clipboard
Writes corrupted packet into pcap
I dumped like 20 MiBs of network data. When I opened the .pcap
in the Wireshark GUI, it told me, it would be corrupted because (at least) one packet size (giving a huge number) exceeds the allowed maximum packet size limit (of less than 2¹⁵).
I found out that after 1 ¼ hours of packet capture, one bigger IP packet was corrupted in the pcap. ~~The total packet size is 1414 (total IP datagram length = 1400) bytes but it actually stores all data together as one packet, an actual packet size of 19701 (total IP datagram length = 19687). The IP datagram total length is too small and ends within JPEG raw data.~~
~~Unsupported configuration?~~
~~I noticed, I increased the MaxPacketSize to 0x10000 from 0x1000 previously (I was afraid packets could be truncated). I was unaware that packet sizes are typically never larger than 16-bit size values.~~
[General]
Enabled=True ; Disables or enables HokakuCafe, can either be True or False
[Net]
Mode=ALL ; Can be either ALL, IPV4, TCP, UDP or PRUDP
MaxPacketSize=0x10000 ; The maximum size written to the file, larger packets will be truncated