Packet Captured Length Is Always 4 Less Than Packet Length

Discussion in 'Capsa Network Analyzer' started by tackyjan, Aug 7, 2012.

Thread Status:
Not open for further replies.
  1. tackyjan

    tackyjan Registered Member

    Joined:
    Aug 7, 2012
    Posts:
    4
    Hi All!!!

    I noticed just now that on every one of my packets the Captured Length property is always 4 (bytes) less than Packet Length.

    http://i144.photobucket.com/albums/r177/tackyjan/capsa-packetsize-offby4.png

    Any ideas as to why this would be? Does this mean I am not getting all the data from the packet that was sniffed?

    An interesting thing I noticed is that when I "decode" my packet (which contains a string message) the string is always chopped off by one character. For example, if I send the message "test1234" the data in the packet analyzer shows "test123".

    Thanks!
     
    Last edited: Aug 7, 2012
  2. Colasoft Support

    Colasoft Support Colasoft Moderator

    Joined:
    Dec 6, 2007
    Posts:
    254
    Hi tackyjan,

    This is a good question!

    Packet Length = Captured Length + FCS Length. FCS length is 4 bytes, and Capsa will drop the FCS, so the captured length is 4 bytes shorter than the Packet length.
     
  3. tackyjan

    tackyjan Registered Member

    Joined:
    Aug 7, 2012
    Posts:
    4
    Yay! Thanks for the answer! Now I have to learn what FCS is. :)
     
  4. tackyjan

    tackyjan Registered Member

    Joined:
    Aug 7, 2012
    Posts:
    4
    I am guessing that the CS in FCS means checksum.
     
Thread Status:
Not open for further replies.