style="display:inline-block;width:728px;height:90px"
data-ad-client="ca-pub-7505528228218001"
data-ad-slot="1225241371">

Unable to fetch payload from TCP packet featuring TCP Segmentation Offloading

2 replies [Last post]
Kabale
Offline
Joined: 07/11/2016

Hello.

I have written some code to fetch payloads from TCP packets. This has worked fine for one PCAP recording, but it seems there is a problem when encountering packets featuring TCP Segmentation Offloading / Large Segment Offloading.

My problem sounds very similar to one raised 2 years ago on http://jnetpcap.com/?q=node/1225 but that thread was locked with a comment confirming the bug and the "promise" of a fix but nothing else. I just want to check if this is still a current issue, and/or if there are any potential workarounds.

I also tried to use the Payload class but setHeader() returns false.

Here's some cut down code:

Ip4 ip = new Ip4();
Tcp tcp = new Tcp();

Pcap pcap = Pcap.openOffline(pcapFile, errbuf);

PcapBpfProgram program = new PcapBpfProgram();
int optimize = 0;         // 0 = false  
int netmask = 0xFFFFFF00; // 255.255.255.0  

if (pcap.compile(program, filterExpression, optimize, netmask) != Pcap.OK) {  
	System.err.println(pcap.getErr());  
	return null;
}

if (pcap.setFilter(program) != Pcap.OK) {  
	System.err.println(pcap.getErr());  
	return null;         
}  

JPacketHandler handler = new JPacketHandler() {

	@Override
	public void nextPacket(JPacket packet, String str) {
		if (packet.hasHeader(ip)) {
			if (packet.hasHeader(tcp)) {
				// snipped packet handling code. This returns false, despite the packet containing TCP header + payload.
			}
		}

Not sure if it is related, but when debugging, the 'tcp' object's 'packet' is actually not the same as the one passed into nextPacket().

Mark Bednarczyk
Offline
Joined: 03/22/2008
Could you provide me with

Could you provide me with tcpdump or wireshark capture file containing sample TOE packets? I will need to fix it at low level. We are overdue for some bug fixes, this would be a good point to start.

Sly Technologies, Inc.
http://slytechs.com

Mark Bednarczyk
Offline
Joined: 03/22/2008
Never mind. I saw that you

Never mind. I saw that you opened up a bug report and attached a sample capture file.

I will get that fixed.

Sly Technologies, Inc.
http://slytechs.com

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.