c++pcapplusplus

How to configure pcapplusplus so it doesn't ignore packets which are greater than MTU size on PcapLiveDevice?


I am using pcapplusplus library for tcp packet processing in c++. When i am receiving packets greater than MTU size, which is 1500 bytes, my program stops further processing as TcpReassembly is not processing that packet. Due to this onMessageReadyCallback is not calling for that packet.

And more serious, as that packet is being ignored by tcpReassembly, the corresponding sequence no, lets say x, of that packet is being ignored too. So my program is not able to process any other incoming packet as it expects a sequence no of x but tcpReassmbly had already ignored that packet so it is not going to receive packet of sequence no x and the program execution stops.

So my question is do we have a way to direct tcpReassembly do not ignore packets greater than MTU size. Just forward it to respective function callback?


Solution

  • Basically the problem was with tcpreplay and not the pcpp::TcpReassembly. Tcpreplay can’t send packets which are larger than the MTU of the interface [https://tcpreplay.appneta.com/wiki/faq.html].

    So Now lemme state where the problem was occuring. I had a pcap file and I was using tcpreplay to replay those packets on an interface. But tcpreplay doesn't replay jumbo packets. It simply ignored those packets.

    So when that packet is ignored, TcpReassembly was waiting for that sequence number, but it would never got that sequence number in future also because that sequence number was ignored already.

    Although next packets will come, but TcpReassembly doesn't go ahead without receiving that ignored sequence no packet. So program execution stopped, much like that the application hanged, but that's on tcpreplay end, not the TcpReassembly end. You need not worry about TcpReassembly, it will reassemble any packet that it would receive. There is not any limitation with MTU size. I checked the cpp file of TcpReassembly as well and there is no check that if packet size is greater than MTU size, then ignore packet.