search

irontec / sngrep

Ncurses SIP Messages flow viewer
GNU General Public License v3.0
970 stars 190 forks source link

Feature-Request: Add support for IPv6 assembly #321

Open sergey-safarov opened 3 years ago

sergey-safarov commented 3 years ago

1.4.7 version did not show 200 OK response over IPv6 transport. Please check packets 4 and follows in the attached PCAP file. ipv6.pcap.gz

Kaian commented 3 years ago

Hi @sergey-safarov

Thanks for reporting!

After checking the pcap with wireshark I discovered that those 200 OK packets are not properly indicating the next header protocol is UDP (that should be 17). Because of that, sngrep is ignoring those packets with invalid protocol 44.

ipv6notudp

Regards!

sergey-safarov commented 3 years ago

Could you look rfc8200 4.5. Fragment Header about.

The Fragment header is identified by a Next Header value of 44 in the immediately preceding header and has the following format:

Looks as when used IPv6 and packet is fragmented, then added "Fragment Header". Please check the screenshot. Screenshot from 2020-08-26 16-03-54

Also, Wireshark properly parses this fragmented packet. So, I think packet is correct.

Kaian commented 3 years ago

Hi @sergey-safarov

You're totally right. Actually there seems to be some ip frag header handling code, but IP Reasembly is far from working for IPv6.

The code assumes IPv4 during assembly so it must be updated to handle IPv6 properly. Reassembly code its a bit messy so I will convert this into a feature request and try to implement it for the next major release where assembly code is more clean.

Thanks a lot!

sergey-safarov commented 3 years ago

As a workaround, I switched to use TCP transport and now can see the whole INVITE message.