Describe the bug
Ethernet has a 64-byte minimum frame size. Frames smaller than this (for example, plain TCP ACK without options on IPv4) need to be padded to 64 bytes (60 bytes excluding FCS). tcpreplay-edit (but not tcpreplay) will incorrectly include Ethernet padding bytes in the IP length field.
To Reproduce
Steps to reproduce the behavior:
- Start
tcpdump on the interface where tcpreplay-edit will be run
tcpreplay-edit any pcap with ethernet padding bytes to the interface
- Observe that the replayed packets have the IP length field modified to include padding bytes (Wireshark should complain a lot)
Expected behavior
tcpreplay-edit (like tcpreplay) does not modify the IP length field and keeps the padding.
System (please complete the following information):
- OS: Fedora 39 (Linux 6.6.9-200.fc39.x86_64)
- Tcpreplay Version: latest master, currently 43693c4
Additional context
None