HokakuCafe icon indicating copy to clipboard operation
HokakuCafe copied to clipboard

Writes corrupted packet into pcap

Open krisutofu opened this issue 1 year ago • 7 comments

I dumped like 20 MiBs of network data. When I opened the .pcap in the Wireshark GUI, it told me, it would be corrupted because (at least) one packet size (giving a huge number) exceeds the allowed maximum packet size limit (of less than 2¹⁵).

I found out that after 1 ¼ hours of packet capture, one bigger IP packet was corrupted in the pcap. ~~The total packet size is 1414 (total IP datagram length = 1400) bytes but it actually stores all data together as one packet, an actual packet size of 19701 (total IP datagram length = 19687). The IP datagram total length is too small and ends within JPEG raw data.~~

~~Unsupported configuration?~~

~~I noticed, I increased the MaxPacketSize to 0x10000 from 0x1000 previously (I was afraid packets could be truncated). I was unaware that packet sizes are typically never larger than 16-bit size values.~~

[General]
Enabled=True ; Disables or enables HokakuCafe, can either be True or False

[Net]
Mode=ALL ; Can be either ALL, IPV4, TCP, UDP or PRUDP
MaxPacketSize=0x10000 ; The maximum size written to the file, larger packets will be truncated

krisutofu avatar Feb 20 '24 16:02 krisutofu