Reassembly of fragmented UDP packets

["Alfred E. Heggestad" <aeh () db org>]

Hi

I am using libpcap to sniff UDP packets in a production network,
and analyse the content of certain UDP packets.

Some of the UDP packets are larger than MTU, and split into two
or more IP fragmented packets. I would like to receive the complete
UDP packet in my application..

I am wondering if there is a libpcap option to do automatic
reassembly of UDP/IP packets inside the library? If not then
I guess the solution is to implement a reassembly algorithm
in userspace.


Many thanks in advance


Best regards,

Alfred

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.