Can libpcap collect TCP segments

Question

I need to sniff TCP traffic in my application.

Can libpcap reassemble TCP segments or do I need to do this manually?

The homepage says: "Full documentation is provided with the source packages in the manual page format." After I sudo apt-get install libpcap-devI find only one person pcap. Is all the documentation available or am I just missing something?

thanks

Answer 1

Reassembling packages or streams is not mentioned in pcap (3).

, dsniff libnids IP TCP.

Answer 2

libpcap, TCP- , , .

wirehark "follow TCP stream", (GPLv2) .

Answer 3

( ) :

root@tower:~/desktop/ccan/ccan/tap # dpkg -L libpcap0.7-dev
/.
/usr
/usr/lib
/usr/lib/libpcap.a
/usr/include
/usr/include/net
/usr/include/net/bpf.h
/usr/include/pcap.h
/usr/include/pcap-namedb.h
/usr/share
/usr/share/man
/usr/share/man/man3
/usr/share/man/man3/pcap.3.gz

, , :

root@tower:~/desktop/ccan/ccan/tap # man 3 pcap
Reformatting pcap(3), please wait...

/3 , , . apt-get source, , , , man-.

, , :)

Answer 4

No, libpcap will not reassemble the TCP segment - libpcap captures packets, but packet data processing remains up to the application or library used by the application.

As for man pages, older versions of libpcap only have a pcap (3) man page; in newer versions, besides pcap (3PCAP), there are a bunch of other man pages for certain procedures.