[Winpcap-users] IP Fragmentation

[Gianluca Varenni]

----- Original Message ----- 
From: "Alessandro Baldisserri" <bujia at libero.it>
To: "WinPCap MailingList" <winpcap-users at winpcap.org>
Sent: Friday, September 15, 2006 5:41 AM
Subject: [Winpcap-users] IP Fragmentation


> Hi,
>
> I'm developing an application based on wonpcap library. I want to analyze 
> HTTP traffic incoming and outcoming from a network device.
> I need a confirm of what I understand of winpcap :
> - if I want to analyze TCP stream and consequential HTTP payload I have to 
> implement my self a simil TCP/IP stack... what I say is that packet that I 
> receive is IP packet that may be fragmented, it's right?
> - so if i want to obtain TCP datagram I have to eventually re-assembly IP 
> fragment that arrives separately, it's right?
>
> I need a confirm of this.
>
> Thank's for your answers and sorry for my bad English...

Yes, WinPcap gives you raw packets (Ethernet frames in case you capture from 
an Ethernet card) so you need to take care of IP reassembly and TCP 
desegmentation and stream reassembly.

Have a nice day
GV

>
> Bye,
> Alessandro
>
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users