Detecting missing packets at the end of TCP connection

89 views
Skip to first unread message

alexan...@gmail.com

unread,
Jun 10, 2020, 2:38:58 PM6/10/20
to PcapPlusPlus support
11:12 AM (14 minutes ago)
Hello,

Is there a way to determine if a closed connection still has missing packets from the TcpReassembly library? I tried to keep track of the bytes passed and sequence numbers, but it seems like I am stuck rewriting all of the reassembly logic on top of the library. Any help would be greatly appreciated!

Thanks!

PcapPlusPlus Support

unread,
Jun 11, 2020, 3:59:10 PM6/11/20
to alexan...@gmail.com, PcapPlusPlus support
Hi,

You're correct, there is currently no API that indicates whether packets are missing or not.
However I don't think it's going to be a huge effort to add it.
This indicator can probably be added to the OnTcpMessageReady callback or to TcpStreamData that holds the actual data.
Would you like to give it a shot?

Thanks,
PcapPlusPlus maintainer


--
You received this message because you are subscribed to the Google Groups "PcapPlusPlus support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pcapplusplus-support/3eaeed4d-2e25-4f05-9855-ea3a7e13a969o%40googlegroups.com.

alexan...@gmail.com

unread,
Jun 16, 2020, 3:54:23 PM6/16/20
to PcapPlusPlus support
Thanks for the advice,

I added a bool field in the TcpStreamData struct, but have not been able to figure out where in TcpReassembly code we know with some certainty that the connection has missing data. It seems like, as you said, a pretty small modification but it could be helpful to others as well, so any help would be great.

Thanks again

PcapPlusPlus Support

unread,
Jun 20, 2020, 4:27:30 AM6/20/20
to alexan...@gmail.com, PcapPlusPlus support
Hi,

Here is the place in the code where missing data is identified:

Thanks,
PcapPlusPlus maintainer


--
You received this message because you are subscribed to the Google Groups "PcapPlusPlus support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages