Trouble dealing with raw packets...

[djuhn]

Split clumped packets by 0xFF, or use an efficient debuffer.

Splitting by 0xFF is not a good idea, you should be processing via the packet length.

i was trying to parse using packet length, but there is "rubbish" data following some but not all packets, which presents a problem when some packets are joined together with "rubbish" data in between them.

[Ersan]

I've never experienced this, even using raw sockets with winpcap

[Joe[x86]]

Split clumped packets by 0xFF, or use an efficient debuffer.

Bad idea. What if the packet contains an 0xFF in it's data?

FF 25 08 00 FF FF FF FF

Although unlikely, that's a totally legit SID_PING.

[MyndFyre]

Split clumped packets by 0xFF, or use an efficient debuffer.

Splitting by 0xFF is not a good idea, you should be processing via the packet length.

i was trying to parse using packet length, but there is "rubbish" data following some but not all packets, which presents a problem when some packets are joined together with "rubbish" data in between them.

"rubbish" data that you see between packets in a packet capture will not be delivered to the application using the socket; it's consumed by the TCP/IP stack.  Parse by length, it's the correct way.