udpreplay icon indicating copy to clipboard operation
udpreplay copied to clipboard

UDP packets over MTU contain corrupted bytes around the MTU limit

Open bjubes opened this issue 1 year ago • 1 comments

I'm restreaming a pcap that has large UDP packets that are broken up due to being over the MTU. Wireshark shows this as "fragmented ipv4 protocol" as well as the final large UDP packet. However, when i try to replay these, around the MTUth byte, i will get invalid characters (non ascii but all the udp data is ascii). The data is correct in wireshark but invalid when listening via netcat nc -ul

image

bjubes avatar Oct 11 '24 18:10 bjubes

Hi @bjubes , looking at the code I think your issue is that udpreplay does not perform IP-Defragmentation. However you can pre-process your data with a Tool like [IPDefragUtil](https://github.com/seladb/PcapPlusPlus/blob/master/Examples/IPDefragUtil/README.md on your recording before replaying it.

If you need a udpreplay version with working Ipv4 Defragmentation support included, I can create a PR with some simple IpDefragmentation to udpreplay,

Tim-S avatar Nov 10 '24 12:11 Tim-S