How can i find opcode from winpcap packets

04/30/2013 13:29 detCode#1
Hello all..
I want to find opcode with listening ethernet device
I am using winpcap library in c#. I have some sniff data in 15884 port but i think opcode location always different and i think winpcap adding ip-port header in data

lets some datas..
Code:
002590A79412648788441400080045000028063D40007806769658F117575FADB607C549E22C74751CEEE5137BFC50100F977FC20000000076965891
Code:
002590A79412648788441400080045000039C16D40007606484BB02135305FADB6071147E22C80F1B20F195CDCF25018FB86631D00000B00747066AD0104FB1E00000109560300
i am trying silkroadsecurity api but this datas is more than normal security silkroad data -.-" i think first 20byte is more..
who have idea ?
04/30/2013 15:07 qkuh#2
I guess the packet is encrypted. You have to decrypt it.
SilkroadSecurity API is working fine.

E: I checked the bitmask. It seems that the packet is not encrypted. Are you sure that the packet is a correct one?
04/30/2013 17:18 Schickl#3
Joymax did a bad job at some points as it seems
Some time ago I used wireshark to capture some packets and noticed that some contain data from older ones
length and everything is fine, except that the server sends more data than it needs to
no idea why, though

Just remove the crap from the end and you'll be fine
04/30/2013 21:07 qkuh#4
The server sometimes send multiple packet data in one packet. They do not send more data than required.
04/30/2013 21:29 lesderid#5
Quote:
Originally Posted by Schickl View Post
Joymax did a bad job at some points as it seems
Some time ago I used wireshark to capture some packets and noticed that some contain data from older ones
length and everything is fine, except that the server sends more data than it needs to
no idea why, though

Just remove the crap from the end and you'll be fine
Are you sure it's older data? TCP is a streaming protocol, so it's possible that one physical TCP message contains more than one logical SRO packet.
04/30/2013 22:00 Schickl#6
Quote:
Originally Posted by qkuh View Post
The server sometimes send multiple packet data in one packet. They do not send more data than required.
Quote:
Originally Posted by lesderid View Post
Are you sure it's older data? TCP is a streaming protocol, so it's possible that one physical TCP message contains more than one logical SRO packet.
I saw data from an older(obviously longer) packet there
no structure of a new one
So I would say yes, it's from an older packet