Question

我正在使用JPcap Library（Keita Fujii）从我的wifi设备中捕获http包。这很好用，但如果http响应的内容大小很大，那么包就会碎片化。实际上TCPPacket-Class的psh-Flag帮助我找出响应是否碎片化，但这是最好的方法吗？我正在寻找合并片段数据的好方法。有人可以给我一个暗示吗？

    JpcapCaptor captor = JpcapCaptor.openDevice(devices[1], 65535, true,1000);
    captor.setFilter("tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)",true);

    while (true) {
        Packet packet = captor.getPacket();
        if (packet == null || packet == Packet.EOF)
            break;
        TCPPacket tcppacl = (TCPPacket) packet;
        if (!tcppacl.psh){
            //wait for next package...

Answer 1

我目前的解决方案如下：

class TCPPacketReciver implements PacketReceiver {

    Map<Long, TCPBodyData> tcpBodys = new HashMap<Long, TCPBodyData>();

    @Override
    public void receivePacket(Packet packet) {
        TCPPacket tcppacl = (TCPPacket) packet;
        byte[] body = addBodyData(tcppacl);
        if(tcppacl.psh){
            //body is complete
            //do something else...
        }
    }

    private byte[] addBodyData(TCPPacket packet) {
        TCPBodyData tcpBodyData;
        Long ack = new Long(packet.ack_num);
        if (tcpBodys.containsKey(ack)){
            tcpBodyData = tcpBodys.get(ack);
            tcpBodyData.addBytes(packet.data);
        }else{
            tcpBodyData = new TCPBodyData(packet.data);
            tcpBodys.put(ack, tcpBodyData);
        }

        if (packet.psh){
            tcpBodys.remove(ack);
        }

        return tcpBodyData.getBytes();
    }

    private class TCPBodyData {

        byte[] bytes = null;

        public TCPBodyData(byte[] bytes) {
            this.bytes = bytes;
        }

        public void addBytes(byte[] bytes) {
            try {
                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
                outputStream.write(this.bytes);
                outputStream.write(bytes);
                this.bytes = outputStream.toByteArray();
            } catch (IOException e) {
                e.printStackTrace();
            }

        }

        public byte[] getBytes() {
            return bytes;
        }
    }
}

但我仍然对任何其他解决方案感兴趣。谢谢。

jpcap如何处理碎片化的tcp包？

1 个答案: