Can libpcap reassemble TCP segments

Question

I need to sniff TCP traffic into my application.

Can libpcap reassemble TCP segments or I have to do it manually?

The home page says "Full documentation is provided with the source packages in man page format". After I sudo apt-get install libpcap-dev I only find one man pcap. Is it all the documentation available or I simply missed something?

Thanks

Answer 1

On my (slightly older) system:

root@tower:~/desktop/ccan/ccan/tap # dpkg -L libpcap0.7-dev
/.
/usr
/usr/lib
/usr/lib/libpcap.a
/usr/include
/usr/include/net
/usr/include/net/bpf.h
/usr/include/pcap.h
/usr/include/pcap-namedb.h
/usr/share
/usr/share/man
/usr/share/man/man3
/usr/share/man/man3/pcap.3.gz

Hmm, seems like they should be there:

root@tower:~/desktop/ccan/ccan/tap # man 3 pcap
Reformatting pcap(3), please wait...

You should have man/3 docs, I looked at mine, the formatting is just wretched. I grabbed the source to the library via apt-get source, it looks like the only docs bundled either way are the man pages.

You might try their mailing list, if you do, be sure to answer your question here :)

Answer 2

Packet or stream reassembly is not mentioned in pcap(3).

If I remember correctly, the dsniff tools use libnids to reassemble IP packets and TCP streams.

Answer 3

Three years ago I used libpcap and I had to reassemble TCP streams myself, it's not very difficult but it's full of corner cases.

You may look at wireshark dissectors and «follow TCP stream» option if license (GPLv2) is ok for your project.