Out of order packet processing

Question

Out of order packet processing

lordbuddha opened this issue a year ago · comments

When processing a TCP stream I manage to extract custom messages from that stream, but at some point I lose the framing of those messages. I see in Wireshark I have out of order packets in the capture and I assume that is what is upsetting my code.

Is there a way of processing the packets in a corrected order ?

Jonas Borjesson · Answer 1 · Wed Oct 04 2023 00:43:58 GMT+0800 (China Standard Time)

pkts.io doesn't have automatic support that re-arranges the TCP stream in the correct order. It merely allows you to read the pcaps and you will have to add custom code to do so. Note: I have a Stream interface that would be the place to add your code (so create a TcpStream) but yeah, I've never had the need myself so therefore I haven't implemented it. Pull requests very much welcome! :-)

lordbuddha · Answer 2 · Wed Oct 04 2023 03:58:04 GMT+0800 (China Standard Time)

Thanks for the answer.

Filtering duplicates would be easy, but no idea how the sequence numbers work.

lordbuddha · Answer 3 · Wed Oct 04 2023 05:10:41 GMT+0800 (China Standard Time)

Ah,,, sequence+length = next sequence...