pcap impossible to upload

[adulau]

Dear pcapr,

I have a capture with fragmented IP packet that we are using to test
the "capability"
of reassembly. But the upload always failed claiming that the capture
is corrupted, I'm able
to read with tcpdump or even wireshark. Is there an official way to
transmit such a capture
to pcapr for debugging?

Thanks a lot,

kind regards

[kowsik]

Beyond the packet count and the pcap size limitations, the primary
reason why upload fails is because you forgot to capture with -s 0. In
other words the packets weren't captured in full.

We need to improve the diagnostic message a little too...

K.

[Alexandre Dulaunoy]

On Fri, Feb 27, 2009 at 6:05 PM, kowsik <kow...@gmail.com> wrote:
>
> Beyond the packet count and the pcap size limitations, the primary
> reason why upload fails is because you forgot to capture with -s 0. In
> other words the packets weren't captured in full.

Ok I understand but I just wanted to upload the fragmented version
of another capture (generated with fragrouter) to test the reassembly.
So the initial capture was "-s 0" but the other version is just the fragmented
version of it.

I suppose that you are checking the packet size but it was correct just
highly fragmented. How do you make the test if it's a full capture or not.
Based on the packet total length or based on a minimal value without
header size (+ or - options) ?

Can I send the capture to you ?

Thanks for your great web service,

adulau

--
-- Alexandre Dulaunoy (adulau) -- http://www.foo.be/
-- http://www.foo.be/cgi-bin/wiki.pl/Diary
-- "Knowledge can create problems, it is not through ignorance
-- that we can solve them" Isaac Asimov

[Aaron Turner]

On Fri, Feb 27, 2009 at 9:45 AM, Alexandre Dulaunoy <adu...@gmail.com> wrote:
>
> On Fri, Feb 27, 2009 at 6:05 PM, kowsik <kow...@gmail.com> wrote:
>>
>> Beyond the packet count and the pcap size limitations, the primary
>> reason why upload fails is because you forgot to capture with -s 0. In
>> other words the packets weren't captured in full.
>
> Ok I understand but I just wanted to upload the fragmented version
> of another capture (generated with fragrouter) to test the reassembly.
> So the initial capture was "-s 0" but the other version is just the fragmented
> version of it.
>
> I suppose that you are checking the packet size  but it was correct just
> highly fragmented. How do you make the test if it's a full capture or not.
> Based on the packet total length or based on a minimal value without
> header size (+ or - options) ?

There is a field in the beginning of every pcap file which says what
it's "snaplen" is. There's another header for each packet which says
what the original packet length was and what the captured length in
the pcap is.

> Can I send the capture to you ?

If you want to send it to me, I can take a look and if all the packet
data is there I can fix the file and upload it for you.

--
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little
temporary Safety,
deserve neither Liberty nor Safety.
-- Benjamin Franklin

[kowsik]

Thanks Aaron. As for defragmentation, pcapr doesn't do
IP-defragmentation. The stream reassembly is mostly about
consolidating messages from the sender that spans multiple packets and
aggregating the bytes. This seems to work for 90% of the cases. I'm
sure that we can improve upon this tremendously to handle overlapping,
reordered packets and so on. On the other hand, you can always reorder
packets by dragging them around (the little blue drag handles to the
left of each packet) and then regenerating the stream. User-driven
stream reassembly. ;-)

K.

On Fri, Feb 27, 2009 at 9:45 AM, Alexandre Dulaunoy <adu...@gmail.com> wrote:
>