Ask Your Question
0

npcap packet reassembly

asked 2023-09-27 13:16:57 +0000

gvayl gravatar image

Can any npcap library functions reassemble fragmented packets? Right now we are using pcap_next_ex and we get fragments. Would like to know if possible to get the assembled message.

TIA

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2023-09-27 13:22:02 +0000

grahamb gravatar image

This is a question for the ncap folks over at npcap.com. I believe they're try to catch up with libpcap API, about which I know nothing.

Here are some links to libpcap specifically and the TCPDump site which covers libpcap as well.

edit flag offensive delete link more

Comments

I believe they're try to catch up with libpcap API

Given that they provide the libpcap API by compiling iibpcap code and shipping it as one of the libraries, there's not much catching up to do - I think they're currently based on libpcap 1.10.4, which is the current libpcap release.

Guy Harris gravatar imageGuy Harris ( 2023-09-28 01:27:39 +0000 )edit

I wasn't aware that npcap was now current with libpcap, looking at the release notes I can see that occurred in npcap 1.74, which has a critical regression so use 1.75 or later.

Current stable Wireshark (4.0.8) still installs npcap 1.71. That will change with the 4.2.x release.

As far as libpcap library use goes, the current Windows version of Wireshark is compiled with libpcap1.10.1.1

grahamb gravatar imagegrahamb ( 2023-09-28 07:49:26 +0000 )edit

As far as libpcap library use goes, the current Windows version of Wireshark is compiled with libpcap1.10.1.1

...which differs from 10.1.4 only for bug fixes; no new APIs were introduced, at least as per diffs between pcap/pcap.h.

Guy Harris gravatar imageGuy Harris ( 2023-09-29 01:03:04 +0000 )edit
0

answered 2023-09-28 01:24:23 +0000

Guy Harris gravatar image

Can any npcap library functions reassemble fragmented packets?

No. It's libpcap plus driver code (and a library that the libpcap code uses to communicate with the driver), and libpcap's purpose is to deliver raw packets to an application; it's up to the application to do reassembly. Wireshark, for example, has code to do IP reassembly.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2023-09-27 13:16:57 +0000

Seen: 86 times

Last updated: Sep 28 '23