CODEWITHSUNDEEP
linuxnetwork-programmingtcplibpcappacket-capture
reddi hari
reddi hari

Reputation: 193

Network and Transport layer functionalities on Captured packets

I have a Client and Server programs communicating on TCP, implementing IEC-60870-5-104 protocol on the application layer. I am sniffing a copy of all traffic between them, How do I exactly replicate the IP and TCP layer functionalities on packets sniffed from libpcap in C ?. like IP-reassembly, Managing out-of-order segments, re-transmission, and duplicate TCP segments and separating PDUs, such that I get the same packet as if I was sniffing on the application layer at the Server. (Also please suggest any Frame-works which helps to do this).

Upvotes: 0

Views: 93

Answers (1)

Gil Hamilton
Gil Hamilton

Reputation: 12357

This is a very difficult and involved task. It's what network intrusion detection / deep packet inspection systems do and AFAIK there is no drop-in library that handles it.

Your best bet is to build on an existing system such as Bro or Suricata (or maybe wireshark internals) that is already doing the session tracking, state management, re-assembly, re-ordering, duplicate detection, etc. You can then add your own application layer decoding to operate on the re-assembled data stream provided.

Upvotes: 1

Related Questions