4 ms·
I've found libpcap to be a very simple API to use given the power of what it's able to do. However, if you're trying to work with things like TCP streams, writi
by tcas 12y ago
I've found libpcap to be a very simple API to use given the power of what it's able to do. However, if you're trying to work with things like TCP streams, writing the reordering logic can be a huge timesink.
The only non GPL solutions I've found are libntoh[1] and libtins[2]. Both are nice, but libtins is much more powerful out of the box, taking care of the pcap code as well. There's one or two things I don't like with the API of libtins, but overall it's a pretty nice library if you want to capture / inject packets.
[1] https://github.com/sch3m4/libntoh https://github.com/sch3m4/libntoh
[2] http://libtins.github.io/ http://libtins.github.io/
- tptacek 12y agoVern Paxson taught me a very simple trick to implementing TCP reordering: For each TCP flow (each side of an open connection), open a file. Remember the initial sequence number (ISN) for the flow. Now, when a new segment comes in, use its seqno delta the ISN to seek to the correct offset in the file; write the segment contents to that location. This is, like, 10 lines of code. Naturally, in a production application, you won't really use FILE-stars or fds to track connections. But it's very straightforward to build an array-based ADT that provides the open/close/read/write/seek semantics of a file --- much simpler than TCP. Meanwhile, you get to start with working code to test against.
- theoh 12y agoThis reminds me of David Clark's interesting algorithm for datagram reassembly. It puts information about the remaining holes in the datagram into the spaces themselves. http://tools.ietf.org/html/rfc815 http://tools.ietf.org/html/rfc815