No SYN received on TCP Stream

[telaoumatenyanis]

Hello,

I have an issue on MacOS, my TCP Stream sometimes stops working for no reason.

After looking at the code, I realized that the streams were created when a SYN was intercepted. However, sometimes I don't receive any tcp packet with a SYN flag set to 1.

Here is my code:

// New stream is seen
void on_new_stream(Stream &stream)
{
    std::cout << "New Stream: "
              << "client:" << stream.client_port() << " to " << stream.server_addr_v4().to_string() << ":" << stream.server_port() << std::endl;
}

int main()
{
    parseLookup();

    SnifferConfiguration config;
    config.set_promisc_mode(true);
    config.set_filter("tcp");
    // Create our follower
    Tins::TCPIP::StreamFollower follower;

    // Set the callback for new streams. Note that this is a std::function, so you
    // could use std::bind and use a member function for this
    follower.new_stream_callback(&on_new_stream);

    Sniffer sniffer("en0", config);

    // And start sniffing, forwarding all packets to our follower
    sniffer.sniff_loop([&](PDU &pdu) {
        TCP* tcp = pdu.find_pdu<TCP>();
        std::cout << tcp->flags() << std::endl;
        follower.process_packet(pdu);
        return true;
    });
}

Tests are made by going through some google/facebook pages.

Here is an example of the logs

194
82
16
24
16
16
16
16
24
16
24
24
194
18
16
24
16
24
16
24
24
24
16
24
16
24
16
24
16
24
16
24
16
24
16
24
16

There is no 2 (SYN) logged. Thus no streams are created.