4 ms·
Is there a way to place the BPF filter after IP packet reassembly? Otherwise, matching for TCP port, etc. fails to capture fragments which do not have the TCP
by nimrody 4y ago
Is there a way to place the BPF filter after IP packet reassembly?
Otherwise, matching for TCP port, etc. fails to capture fragments which do not have the TCP header and the resulting file is missing some data.
- toast0 4y agoI'm not sure, but you can probably just capture all ip fragments and do a second pass with something later? When I was running a webserver with worldwide audience and 40+ Gbps traffic (most of that was our apk though), I saw no more than a couple fragments per second; unless there was some UDP reflection DDoS going on and I was getting fragments from that. Lots of high profile sites don't even accept ip fragmentation because it's too costly to deal with.
- johnnny 4y agoTCP tries really hard to avoid fragmentation, by setting the DF flag and reducing the MSS when it sees a PTB error. Of course that sometimes fails, so if you still have TCP fragmented segments, the next best thing is to filter by source/destination address, saving to a PCAP file, then run tshark on that file with the "-2" flag which does packet reassembly. (I don't know if tshark can be made to do on-the-fly reassembly, that would require keeping a buffer of un-reassembled fragments until the rest of the packets are seen.)
- tptacek 4y agoThe direct answer to your question is "no", because tcpdump isn't stateful. It reads fragments one at a time, prints them, and forgets about them.