Re: Reassembly of fragmented UDP packets

[Guy Harris <guy () alum mit edu>]

Alfred E. Heggestad wrote:

> I am wondering if there is a libpcap option to do automatic
> reassembly of UDP/IP packets inside the library?

No.  Libpcap is, by design and intent, a low-level library for capturing 
and sending raw link-layer packets.

> If not then
> I guess the solution is to implement a reassembly algorithm
> in userspace.

Yes - that's how Wireshark does it, for example.

Now, note that libpcap is also "in userspace" in the sense that it 
doesn't itself contain any code that runs in kernel mode; if you meant 
"in the application", note also that Wireshark's dissection is 
implemented in a library (albeit one that does not currently have a 
stable API).
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.