ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] Length reported in UDP header

From: Rayne <hjazz6@xxxxxxxxx>
Date: Wed, 29 Jul 2009 21:34:51 -0700 (PDT)
Hi all,

Is it common for UDP packets to have the length in its header reported
wrongly? I'm writing a program that simply parses through the various
headers in a packet, and I'm getting a lot of values larger than 1500
in my variable "size_udp", which is obtained via

size_udp = ntohs(udp->len);

where udp points to the beginning of the UDP header and len is the
length field in the UDP header.

I'm not sure if I'm parsing incorrectly, or if it's inherent in UDP
packets, as I do get correct size_udp values for other UDP packets as
well.

Thank you.