PcapPlusPlus
22.11
|
#include "Packet.h"
#include "LRUList.h"
#include "IpAddress.h"
#include "PointerVector.h"
#include <map>
Go to the source code of this file.
Classes | |
class | pcpp::IPReassembly |
class | pcpp::IPReassembly::PacketKey |
class | pcpp::IPReassembly::IPv4PacketKey |
class | pcpp::IPReassembly::IPv6PacketKey |
Namespaces | |
pcpp | |
The main namespace for the PcapPlusPlus lib. | |
Macros | |
#define | PCPP_IP_REASSEMBLY_DEFAULT_MAX_PACKETS_TO_STORE 500000 |
This file includes an implementation of IP reassembly mechanism (a.k.a IP de-fragmentation), which is the mechanism of assembling IPv4 or IPv6 fragments back into one whole packet. As the previous sentence imply, this module supports both IPv4 and IPv6 reassembly which means the same pcpp::IPReassembly instance can reassemble both IPv4 and IPv6 fragments. You can read more about IP fragmentation here: https://en.wikipedia.org/wiki/IP_fragmentation.
The API is rather simple and contains one main method: pcpp::IPReassembly::processPacket() which gets a fragment packet as a parameter, does the reassembly and returns a fully reassembled packet when done.
The logic works as follows:
In order to limit the amount of memory used by this mechanism there is a limit to the number of concurrent packets being reassembled. The default limit is PCPP_IP_REASSEMBLY_DEFAULT_MAX_PACKETS_TO_STORE but the user can set any value (determined in pcpp::IPReassembly c'tor). Once capacity (the number of concurrent reassembled packets) exceeds this number, the packet that was least recently used will be dropped from the map along with all the data that was reassembled so far. This means that if the next fragment from this packet suddenly appears it will be treated as a new reassembled packet (which will create another record in the map). The user can be notified when reassembled packets are removed from the map by registering to the pcpp::IPReassembly::OnFragmentsClean callback in pcpp::IPReassembly c'tor
#define PCPP_IP_REASSEMBLY_DEFAULT_MAX_PACKETS_TO_STORE 500000 |
IP reassembly mechanism default capacity. If concurrent packet volume exceeds this numbers, packets will start to be dropped in a LRU manner