Getting the length of an ipv4 payload from the packet

Getting Help
1

Hi

I was working on some packet inspection and I am unable to figure out how to find out the length of an ipv4 packet’s payload.

The IPv4 struct has a property Length but that seems to contain the length of the full header.

Could someone point me in the right direction with this?

Thank you!

2

It’s Total Length minus the header length indicated by the IHL field, unless whatever you’re using to parse the packet does something else with those values.

3

The size values I’m getting are quite large, the payloads have nowhere close to that many indices in them.
Am I doing anything wrong?

 func getTotalLength(packet gopacket.Packet) uint16 {
	var ( 
			eth layers.Ethernet
			ipv4 layers.IPv4
			ipv6 layers.IPv6
			tcp layers.TCP
			err error
		)
	 parser := gopacket.NewDecodingLayerParser(
	 		layers.LayerTypeEthernet,
	 		&eth,
	 		&ipv4,
			&ipv6,
			&tcp)

	var layersInPacket []gopacket.LayerType

	err = parser.DecodeLayers(packet.Data(), &layersInPacket)
	var total_len uint16
        total_len = 0
       if err == nil {
	      total_len = ipv4.Length - uint16(ipv4.IHL * 4)
       }
	return total_len
}
4

Doesn’t look entirely unreasonable, but I guess compare to what you see in wireshark or so for the same packets?

5

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.