TCP packet assembly

[jbhasin83]

Hello,

I have created a packet sniffer application. During the sniffing I calculate the byte count of each individual download. When a download starts I store the sequence number of the first packet in an array position and based on bytes from the first packet I cacluate the expected sequence number of the next packet. But if the expected sequence number does not match because the packets are now out of sequence then I loose the count and in this situation I dont know that how can I calculate the byte count. 

Please suggest what can be done to resolve this situation.

[Mark_Yedinak]

I'm curous why your are effectively trying to implement the TCP protocol. The stack should already handle that for you. Or are you trying to reassemble packets from a trace. You will need more than just the sequence number to reassemble the packets. You will need to keep track of the connections as well and will need to account fr missing or out of order packets when reassembling. This means you will need to maintain some buffers for assembling your packets and keep track of what you have so far, what pieces you are missing or out of order. Like I said, you are basically trying to implement the TCP protocol itself.

[jbhasin83]

Well, my main aim is to calculate bytes of each download. For example if there are 5 file download happening at a time then I should be able to log the byte count against the URL of each file download happening. Hence I need some information that how can I track and can you give a sample code with what you mean by keeping track of connection means?

[Mark_Yedinak]

How are your capturing the packets? The packet cature should include the source and destination addresses as well as the source and destination port numbers. You will get a unique set of these values for every TCP connection. Even if you opened 5 connections to a server from the same computer each connection would vary in the source port. You would have to track these parameters and the sequence number associated with each. I do not have any samples to post as I don't do this type of thnig in LabVIEW. I have extracted data from network traces but it was extracting it from text logs of a trace and the assumption was that the packets were in order. The newtork was well behaved.

It would really help if you could post what you have done so far.

[jbhasin83]

I have created a socket to read tcp incomming packets. The source port in the tcp header remains the same for all the 5 downloads. I cannot use the source IP address as for testing I am downloading from the same URL. I saw that source port remains 80 in all the 5 downloads.

[jbhasin83]

For packet capture I am using recvfrom function.

[nathand]

Just curious, what does this have to do with LabVIEW?

Check the destination (local) port.  Each download should have a unique port on your local machine but the same source port (80 is http).  That local port is likely to be assigned randomly when the download starts.