I installed wireshark in my xp system which needs libpcap lib. Well, my program needs libpcap too.. But,when i capture in my c program, i found something very interesting.. I captured a http package, whose size is more 3000 bytes. but in my program, it takes only one loop, because every ip package take less than 1500 bytes, which means, libpcaps concatenated the several packages together???? But the checksum is error for the concatenated packages. Maybe you can try it... But i dont know whether the libpcap concatenated my ip packages?
in the picture, the second package has 3311 bytes. I am wondering it is the libpcap or wireshark reconstruct the fragments...