Introduced change creates problem with spurious data

[aasselin]

Hello

tcpflow/src/tcpdemux.cpp

Line 748 in 6fd956d

uint16_t ip_payload_len = pi.ip_datalen - ip_header_len;

the old code here would read :
uint16_t ip_payload_len = ip_len - ip_header_len;

it was changed to:
uint16_t ip_payload_len = pi.ip_datalen - ip_header_len;

but the new codes just ignores the header information.
In our use case, there are 2 to 6 paddings bytes at the end of the IP data packet, introduce by some hardware device.

Please revert the code.
Regards

[simsong]

Thanks for the patch. I'll do something better. Can you share with me some packets for testing?
I've added a lot of unit tests to bulk_extractor. For tcpflow I should do the same. I should also upgrade it to use the be20_api rather than the be16_api.

[aasselin]

I check if I can provide you with a .pcap, the data flow is a private flow, I am not sure that I have the right to provide it.

[simsong]

Don’t provide it if is private!