Ignore packets with an IP header smaller than 20.

This is invalid according to RFC 791. Fixes #49.
elastic · Aug 2, 2014 · 584c5e9 · 584c5e9
1 parent 4ea6f4d
commit 584c5e9
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/main.go b/main.go
@@ -110,13 +110,16 @@ func decodePktEth(datalink int, pkt *pcap.Packet) {
 
     // IP header
     iphl := int((uint16(pkt.Data[l2hlen]) & 0x0f) * 4)
+    if iphl < 20 {
+        DEBUG("ip", "IP header shorter than 20 bytes, ignoring")
+        return
+    }
     if len(pkt.Data) < l2hlen+iphl {
         DEBUG("ip", "Packet too short to be IP")
         return
     }
     iphdr := pkt.Data[l2hlen : l2hlen+iphl]
 
-    //DEBUG("Packet timestamp: %s", pkt.Time)
     packet.ts = pkt.Time
 
     packet.tuple.Src_ip = Bytes_Ntohl(iphdr[12:16])