Ask Your Question

1576 bytes on wire, 790 bytes captured!

asked 2019-03-19 11:19:38 +0000

I have written a small program which sends 758 bytes to a UDP port. Wireshark reports that the data part of the packet is indeed 758 bytes and the whole packet is 790 bytes, so far so good, but, it's also reporting 1576 bytes on the wire (and the receiving app doesn't like the packet). I figured it must be something in my code, however, it seems fine on other PCs, so it's something wrong with this particular PC running Window 7.

Any ideas what might be the cause?

edit retag flag offensive close merge delete


Any chance of a link to the capture so we can look at it ourselves rather than guessing?

grahamb gravatar imagegrahamb ( 2019-03-19 11:28:56 +0000 )edit
weird_dave gravatar imageweird_dave ( 2019-03-19 15:23:47 +0000 )edit

I think this is more an npcap\loopback artefact.

grahamb gravatar imagegrahamb ( 2019-03-19 15:58:11 +0000 )edit

I'm inclined to agree.

weird_dave gravatar imageweird_dave ( 2019-03-19 16:08:48 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-03-19 22:25:38 +0000

Guy Harris gravatar image

updated 2020-05-20 21:08:43 +0000

Graham's probably right - this is probably something weird about Npcap's loopback device.

I would suggest that you report an npcap issue.

(That's now done on Npcap's GitHub issues page - click the "New issue" button on the right.)

edit flag offensive delete link more


FWIW, I see the same., I didn't see an existing issue for this.

grahamb gravatar imagegrahamb ( 2019-03-19 22:38:27 +0000 )edit

I created nmap issue 1524 for this.

grahamb gravatar imagegrahamb ( 2019-03-19 22:50:35 +0000 )edit

Awesome! Thanks :)

weird_dave gravatar imageweird_dave ( 2019-03-20 09:21:19 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-03-19 11:19:38 +0000

Seen: 197 times

Last updated: May 20 '20