Fill missing sements with zeros

[DanielAW]

Hi,

I'm using tcpflow to extract TCP flows, which I then want to compare. Some fragements are missing in one of these pcap captures (Indicated by "TCP Previous segment not captured" in Wireshark).

In my experiments, tcpflow seems to fill up these missing fragments with zeros. This is a very useful feature in my case. Wireshark does not seem to do that if I try to export data with the "Follow TCP Stream" option.
I'm just wondering how it works in detail. How does tcpflow know the size of the missing fragment? Does it just use the size of the last fragment?

Regards Daniel

[DanielAW]

Ok, I think I figured it out by myself:

Tcpdump acts as follows for the segment after the missing one:
- If it detects a missing frame, it first seeks the output file for the size of the current tcp data length (this is also how the zeros are generated)
- After this it writes the data of the current file to the output file

I'm currently not sure how tcpdump detects a missing segment.

[Simson Garfinkel]

It doesn't detect missing segments. It just seeks to where the data are inserted for new segments.

--
You received this message because you are subscribed to the Google Groups "tcpflow-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tcpflow-user...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[DanielAW]

Thanks for your reply :-)

But it checks if the current sequence number is the expected next sequence number right?

[Simson Garfinkel]

I don't remember. If it does, it is just checking that for statistical reporting. 

[DanielAW]

OK, thanks again. I think this is ok for my purposes :-)