mozillazg / ptcpdump

Process-aware, eBPF-based tcpdump
MIT License
613 stars 43 forks source link

TCP: support SACK #155

Closed matttbe closed 2 months ago

matttbe commented 2 months ago

In case of TCP SACK, we can see unknown-5:

[.], seq 2097640378, ack 3168775922, win 1036, options [...,unknown-5 0xbcdfab12bcdfaef2,...], length 0

tcpdump displays this:

[.], ack 3168775922, win 1036, options [...,sack 1 {3168774930:3168775922},...], length 0

(I was able to reproduce it with ./mptcp_join.sh -c "fastclose test" test)

I think GOPacket supports SACK, but not pktdump, which only supports "sackOK".

I can report this issue to https://github.com/x-way/pktdump project if you prefer. (It is not clear to me if you are planning to "upstream" the modifications you did or continue as a fork :) ; pktdump's maintainer seems open to new changes: https://github.com/x-way/pktdump/issues/33 )