Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Fragment offset is shared with flags. You have the "DF" (don't fragment) bit set.</p> <p>Which gives you 16384 for the entire 16-bit field, given the fragment offset of 0. </p> <p>Take a look at the <a href="http://www.ietf.org/rfc/rfc791.txt" rel="nofollow noreferrer">http://www.ietf.org/rfc/rfc791.txt</a>, starting from page 10.</p> <p><strong>EDIT</strong>:</p> <p>The DF bit in the TCP segments that you are receiving is set by the remote side, to perform the <a href="http://www.ietf.org/rfc/rfc1191.txt" rel="nofollow noreferrer">Path MTU discovery</a> - in a nutshell, to try to avoid the fragmentation. In this case the sending side learns the biggest MTU that the overall path can handle, and chops the TCP segments such that they did not exceed it after the encapsulation into IP. </p> <p><strong>EDIT2</strong>:</p> <p>regarding the use of recvfrom() and TCP: TCP is a connection-oriented protocol, and all of the segmentation/fragmentation details are already handled by it (fragmentation is obviously handled by the lower layer, IP) - so you do not need to deal with it. Anything you write() on the sending side will be eventually read() on the other side - possibly <strong>not</strong> in the same chunks though - i.e. two 4K writes may result in a single 8K read sometimes, and sometimes in two 4K reads - depending on the behaviour of the media inbetween concerning reordering/losses.</p> <p>IP Fragmentation and reassembly is handled transparently by the operating system, so you do not need to worry about it, same as about packets out of order, etc. (you will just see the decreased performance as the effect on the application).</p> <p>One good read I could recommend is this one: <a href="http://www.unpbook.com/" rel="nofollow noreferrer">UNIX network programming</a>. Given Steven's involvement with the TCP, it's a good book no matter which OS you use.</p> <p><strong>EDIT3:</strong></p> <p>And if you are doing something to be a "man in the middle" (assuming you have good and legitimate reasons for doing so :-) - then you can assess the upcoming work by looking at the prior art: <a href="http://chaosreader.sourceforge.net/" rel="nofollow noreferrer">chaosreader</a> (one-script approach that works on pcap files, but adaptable to something else), or <a href="http://libnids.sourceforge.net/" rel="nofollow noreferrer">LibNIDS</a> - that does emulate the IP defragmentation and the TCP stream reassembly; and maybe just reuse them for your purposes.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload