Parsing Wireshark Capture Files

edit

Incl Size: 1514

That's the number of bytes of the frame that were captured. That's a full-size Ethernet packet, but without the FCS (which is often not provided to the host by the adapter, by default).

Orig Size: 1514

That's the number of bytes of frame that were on the wire. The Incl Size is equal to the Orig Size, so nothing was chopped off ("sliced") by the capture process having a snapshot length shorter than the maximum frame size.

However, the packets I am parsing.. which I guess would be the TCP packets payload, has its own size in the payload header which is 16244 Bytes.

The packets you're parsing would be the payload of the TCP segments.; a packet at a layer above the link layer can be larger than a single link-layer packet, and parsing that requires assembling multiple link-layer packets together. See SYN-bit's answer for the rest of your questions.

Since TCP is a streaming protocol, the packet bounderies are just artificial cuts in the data stream. This is needed because every network has a finite maximum length per packet, this maximum length is called the Maximum Transmission Unit (MTU). For normal ethernet, the MTU is 1500. This means ethernet can send 1500 bytes of data to another ethernet host. From this 1500 bytes, 20 bytes are needed for the IP header and 20 bytes are needed for the TCP header, leaving 1460 bytes for the TCP payload. This is what is called the Maximum Segment Size (MSS). If TCP needs to sends a block of data (a higher layer Protocol Data Unit (PDU)) that is larger than this MSS, it will break up the PDU into smaller pieces of size MSS and send those segments as individual packets to the receiver. The receiver then strips the ethernet/IP/TCP headers and places the TCP segment in the receive buffer. All segments are processed that way until the full PDU is received and the data can then be handed over to the application in one piece.

If I have read your question correctly, you are trying to parse a pcap file in which there are packets of protocol X which are transported over TCP. Protocol Data Units (PDUs) of protocol X have a length header that indicate the length of the PDU. However that length can be greater than the Maximum Segment Size (MSS), therefor the PDU will not fit into one packet as explained. Your parser needs to read the length of the PDU and it will need to keep reading TCP packets until all bytes of the PDU are received so that it can dissect it. This is called reassembly in Wireshark and your parser should do something similar too.