libtins  3.4
 All Classes Namespaces Functions Variables Typedefs Enumerations Enumerator Friends Pages
Public Types | Public Member Functions | List of all members
Tins::IPv4Reassembler Class Reference

Reassembles fragmented IP packets. More...

#include <ip_reassembler.h>

Public Types

enum  PacketStatus { NOT_FRAGMENTED, FRAGMENTED, REASSEMBLED }
 
enum  OverlappingTechnique { NONE }
 

Public Member Functions

 TINS_DEPRECATED (typedef PacketStatus packet_status)
 
 IPv4Reassembler ()
 
 IPv4Reassembler (OverlappingTechnique technique)
 
PacketStatus process (PDU &pdu)
 Processes a PDU and tries to reassemble it. More...
 
void clear_streams ()
 
void remove_stream (uint16_t id, IPv4Address addr1, IPv4Address addr2)
 Removes all of the packets and data stored that belongs to IP headers whose identifier, source and destination addresses are equal to the provided parameters. More...
 

Detailed Description

Reassembles fragmented IP packets.

This class is fairly simple: just feed packets into it using IPv4Reassembler::process. If the return value is IPv4Reassembler::FRAGMENTED, then the packet is fragmented and we haven't yet seen the missing fragments, hence we can't reassemble it. If the function returns either IPv4Reassembler::NOT_FRAGMENTED (meaning the packet wasn't fragmented) or IPv4Reassembler::REASSEMBLED (meaning the packet was fragmented but it's now reassembled), then you can process the packet normally.

Simple example:

IPv4Reassembler reassembler;
Sniffer sniffer = ...;
sniffer.sniff_loop([&](PDU& pdu) {
// Process it in any case, unless it's fragmented (and can't be reassembled yet)
if (reassembler.process(pdu) != IPv4Reassembler::FRAGMENTED) {
// Now actually process the packet
process_packet(pdu);
}
});

Member Enumeration Documentation

The type used to represent the overlapped segment reassembly technique to be used.

The status of each processed packet.

Enumerator
NOT_FRAGMENTED 

The given packet is not fragmented.

FRAGMENTED 

The given packet is fragmented and can't be reassembled yet.

REASSEMBLED 

The given packet was fragmented but is now reassembled.

Constructor & Destructor Documentation

Tins::IPv4Reassembler::IPv4Reassembler ( )

Default constructor

Tins::IPv4Reassembler::IPv4Reassembler ( OverlappingTechnique  technique)

Constructs an IPV4Reassembler.

Parameters
techniqueThe technique to be used for reassembling overlapped fragments.

Member Function Documentation

void Tins::IPv4Reassembler::clear_streams ( )

Removes all of the packets and data stored.

IPv4Reassembler::PacketStatus Tins::IPv4Reassembler::process ( PDU pdu)

Processes a PDU and tries to reassemble it.

This method tries to reassemble the provided packet. If the packet is successfully reassembled using previously processed packets, its contents will be modified so that it contains the whole payload and not just a fragment.

Parameters
pduThe PDU to process.
Returns
NOT_FRAGMENTED if the PDU does not contain an IP layer or is not fragmented, FRAGMENTED if the packet is fragmented or REASSEMBLED if the packet was fragmented but has now been reassembled.
void Tins::IPv4Reassembler::remove_stream ( uint16_t  id,
IPv4Address  addr1,
IPv4Address  addr2 
)

Removes all of the packets and data stored that belongs to IP headers whose identifier, source and destination addresses are equal to the provided parameters.

Parameters
idThe idenfier to search.
addr1The source address to search.
addr2The destinatin address to search.
See Also
IP::id

The documentation for this class was generated from the following files: