Reconstructing data from PCAP sniff

Posted by Ishi on Stack Overflow See other posts from Stack Overflow or by Ishi
Published on 2010-05-26T20:38:47Z Indexed on 2010/05/26 20:41 UTC
Read the original article Hit count: 473

Filed under:

http

|

sniffer

|

libpcap

|

defragmentation

Hi everyone !!

I am trying to sniff HTTP data through libpcap and get all the http contents (header+payload) after processing the TCP payload.

As per my discussion at http://stackoverflow.com/questions/2905430/writing-an-http-sniffer-or-any-other-application-level-sniffer , I am facing problems due to fragmentation - I need to reconstruct the whole stream (or defragment it) to get a complete HTTP packet, and this is where I need some help.

Thanks in anticipation !!

© Stack Overflow or respective owner

Related posts about http

Cannot update, apt-get cannot fetch index files

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have a fresh install of Ubuntu 11.10 from the iso 'ubuntu-11.10-desktop-amd64.iso'. I installed this in VMWare Fusion 4.1.1 running on OSX 10.7.3. When setting up the VM, I allowed easy install to take care of creating my user and installing VMWare tools. No problems during installation, everything… >>> More
the size of apt-get update lists is too big

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I ran a clean install to Ubuntu 12.04 and so far everything has been working well. I especially commend the Ubuntu team for this release. I only noticed that the size of repository update is now about ~13MB. Normally, it is about this size for the first time you run apt-get update after a clean install… >>> More
Quantal: Broken apt-index, cant fix dependencies

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I can't seem to add/remove/update packages Ubuntu software update has a notice about partial upgrades but fails Seems to be similar to this problem $ sudo apt-get update Ign http://archive.ubuntu.com quantal InRelease Ign http://security.ubuntu.com precise-security InRelease Ign… >>> More
12.04: Apt-Get Update: failure to fetch; can't connect to any sources

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I realize there are dozens of "apt-get update: failure to fetch" questions (I read through all I could find), but my present circumstance is unique to 12.04 and it affects all sources; not just launchpad. Additionally, I've tried several different servers in Europe and the U.S. as well as the "main… >>> More
How can I remove the Translation entries in apt?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
This is the output of aptitude update: Ign http://archive.canonical.com natty InRelease Ign http://extras.ubuntu.com natty InRelease Ign http://dl.google.com stable InRelease Ign http://security.ubuntu.com natty-security InRelease Hit http://deb.torproject.org natty InRelease Get:1 http://dl.google… >>> More

Related posts about sniffer

Writing an http sniffer (or any other application level sniffer)

as seen on Stack Overflow - Search for 'Stack Overflow'
Dear all, I am trying my hands understanding PCAP libraries. I am able to apply a filter and get the TCP payload at port 80. But what next ? How can I read the HTTP data - suppose I want to know the "User Agent" field value in the http header..how should I proceed ? I have searched the website (and… >>> More
URL Sniffer based on NetFilter SDK

as seen on Code Project - Search for 'Code Project'
How to use NetFilter SDK to develop a URL Sniffer >>> More
http sniffer not working in a LAN setting

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi , I wrote a http sniffer program , first ran it in my standalone pc < fedora OS , and it worked well. And when i tried this in a LAN setting < bus-LAN , fedora OS again , and set the eth0 to promisc mode , the program captures only the URLs browsed by the system in which it is running … >>> More
i am using winsock2.h in c language the following errors are unuderstandable help required?

as seen on Stack Overflow - Search for 'Stack Overflow'
i am going to paste here my code an errors :::: #include "stdio.h" #include "winsock2.h" #define SIO_RCVALL _WSAIOW(IOC_VENDOR,1) //this removes the need of mstcpip.h void StartSniffing (SOCKET Sock); //This will sniff here and there void ProcessPacket (unsigned char* , int); //This will decide… >>> More
Reconstructing data from PCAP sniff

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi everyone !! I am trying to sniff HTTP data through libpcap and get all the http contents (header+payload) after processing the TCP payload. As per my discussion at http://stackoverflow.com/questions/2905430/writing-an-http-sniffer-or-any-other-application-level-sniffer , I am facing problems… >>> More