-
Notifications
You must be signed in to change notification settings - Fork 409
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Wrong PCAP processing for TCP connections #628
Comments
hello, PR maybe your idea? :) |
best heuristics I could come with: *** 757,762 ****
--- 757,765 ----
(dst, dport, src, sport) in self.tcp_connections_seen
or (src, sport, dst, dport) in self.tcp_connections_seen
):
+ if tcp.flags != dpkt.tcp.TH_SYN:
+ if dport > sport:
+ src, sport, dst, dport = dst, dport, src, sport
self.tcp_connections.append((src, sport, dst, dport, offset, ts - first_ts))
self.tcp_connections_seen.add((src, sport, dst, dport))
self.alive_hosts[dst, dport] = True |
thanks, lets see if someone can test it too, as those months im pretty busy |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Again me :)
Problematic block is here
So, TCP connections are recognized by first packet seen, where this can be a problem in lots of specific situations (TCP out of order packets, SYN missing, late PCAP recording because of slow start or similar). In our case,
SYN
packet is just not there, while the responseSYN-ACK
is considered as the initial connection attempt, making CAPE results having mixed source and destination.So, I have couple of ideas on my mind, but I would not like to propose something too complicated for your taste. As you are already using
dpkt
it shouldn't be a too much hustle to check some flags.For example, if first packet is for unknown connection, maybe to check whether it has
SYN
set and treat packet as you do it now, while in case ofSYN-ACK
to reverse the order dst<->src in your connection table. It can be even more complicated that this, but not sure if it is too muchThe text was updated successfully, but these errors were encountered: