tcpdump mailing list archives
Re: Reassembly of fragmented UDP packets
From: Guy Harris <guy () alum mit edu>
Date: Mon, 28 Jan 2008 10:40:45 -0800
Alfred E. Heggestad wrote:
I am wondering if there is a libpcap option to do automatic reassembly of UDP/IP packets inside the library?
No. Libpcap is, by design and intent, a low-level library for capturing and sending raw link-layer packets.
If not then I guess the solution is to implement a reassembly algorithm in userspace.
Yes - that's how Wireshark does it, for example.Now, note that libpcap is also "in userspace" in the sense that it doesn't itself contain any code that runs in kernel mode; if you meant "in the application", note also that Wireshark's dissection is implemented in a library (albeit one that does not currently have a stable API).
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Reassembly of fragmented UDP packets Alfred E. Heggestad (Jan 28)
- Re: Reassembly of fragmented UDP packets Guy Harris (Jan 28)