pcap_tools
pcap_tools copied to clipboard
Don't discard data in TCP segments with the FIN flag set
A TCP segment that has the FIN flag set may also contain data. The following segment contains 848 octets of data and has the FIN flag set:
19:03:37.804959 IP 192.168.180.100.7899 > 192.168.180.101.53209: Flags [FP.], seq 27473:28321, ack 2225, win 272, options [nop,nop,TS val 138775536 ecr 138708319], length 848
RFC 793 states that:
For sequence number purposes, ... the FIN is considered to occur after the last actual data octet in a segment in which it occurs.
When a segment with a FIN flag is detected, PcapTools::TcpProcessor
currently ends stream reassembly without processing data from that segment. This causes the reassembled stream to be truncated when a segment containing data with a FIN flag is encountered.
This pull request changes the order of processing such that the data is appended to the stream prior to checking for and processing the FIN and RST flags.