libpcap IP Packet Reassembly [closed]

Question

I'm looking for a sample code for IP packet reassembly in C with libpcap*. Is IP packet defragmentation implemented in libpcap library officially? I've found this proposal : http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02991.html[this][1] .

Are there any implementation of defragmentation of IP packets.

[1]: http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02991.html [+]

*The reason for looking for the sample code is just for fun and learning and i don't want to spend too much time for writing code for IP packet reassembly.

Answer 1

No, I'm pretty sure that the patch didn't make into libpcap. But you can do ip defragmentation (and also follow TCP streams) with libnids.

Answer 2

If you're looking for a tool that does IP reassembly you can checkout IPDefragUtil. You can also check out out IP reassembly source code here and here

Answer 3

Libpcap is a library to capture raw link-layer packets; it is intended to be used by programs and libraries that do their own processing of those packets, including IP fragment reassembly, etc.. Therefore, it does not, and will not ever, do IP reassembly; that belongs in a separate library.