CODEWITHSUNDEEP
pythonpcap
Vercingatorix
Vercingatorix

Reputation: 1884

Reassembling fragments in a PCAP file

We have largish (100 MiB-3 GiB) PCAP files that have huge UDP datagrams that are heavily fragmented, and we need to process them in Python, preferably datagram-by-datagram without reading everything into memory first, due to the potential size of the files. I'm looking for a package that is capable of reading and reassembling IP packets. I've looked at pypcapfile, dpkt, and scapy. Of these, AFAICT only scapy reassembles fragments, but it requires reading the file entirely into memory first, and anyway the GPLv2 license is intolerable in our organization. Are there any other PCAP reading and processing packages out there that will decode and do fragment reassembly, preferably datagram-by-datagram?

Alternatively -- this is not a python question -- is there an OTS command-line tool that will reassemble packets from one PCAP to another? I tried tshark with -r, -w, and -Y ip.flags.mf==0 or -R ip.flags.mf==0 and so far no dice.

Upvotes: 4

Views: 1064

Answers (1)

Nagmat
Nagmat

Reputation: 380

Regarding the last part, this may be the solution:

tshark -nlr $infile -qz "follow,tcp,raw,$stream" | tail -n +7 | sed 's/^\s\+//g' | xxd -r -p > ${outfile}.txt

Upvotes: 1

Related Questions