search

bpaquet / pcap_tools

Some tools to proccess tcpdump dumps
Other
16 stars 3 forks source link

Don't discard data in TCP segments with the FIN flag set #12

Open philr opened 8 years ago

philr commented 8 years ago

A TCP segment that has the FIN flag set may also contain data. The following segment contains 848 octets of data and has the FIN flag set:

19:03:37.804959 IP 192.168.180.100.7899 > 192.168.180.101.53209: Flags [FP.], seq 27473:28321, ack 2225, win 272, options [nop,nop,TS val 138775536 ecr 138708319], length 848

RFC 793 states that:

For sequence number purposes, ... the FIN is considered to occur after the last actual data octet in a segment in which it occurs.

When a segment with a FIN flag is detected, PcapTools::TcpProcessor currently ends stream reassembly without processing data from that segment. This causes the reassembled stream to be truncated when a segment containing data with a FIN flag is encountered.

This pull request changes the order of processing such that the data is appended to the stream prior to checking for and processing the FIN and RST flags.