Problem with TcpReassembly and chunked transfer encoding about pcapplusplus HOT 6 CLOSED

Thanks for hints.

I observed when I changed snapshotLength to 65536, this problem was also fixed.

from pcapplusplus.

can you provide pcap files?

from pcapplusplus.

chunked traffic.zip

from pcapplusplus.

I have this POC code to read from pcap: https://pastebin.com/31LxGqJU

But in this case, I cannot observe this bug.. 🤔 https://justpaste.it/a5knx

from pcapplusplus.

After some retries I can also observe "6272 bytes missing" (nondetermistically printed):

"amount":22990,"photoUrl":"https://rukminim1.flixcart.com/image/832/832/k7nnrm80/refrigerator-new/6/z/f/gl-s292rdsy-2-lg-original-imafpujn
TCP data from port 49912 to port 5000 | Data length: 25 bytes
Data: [6272 bytes missing]0


TCP connection ended between 127.0.0.1:49912 and 127.0.0.1:5000 | Reason: 0

from pcapplusplus.

@davidbolvansky it's hard to say why this is happening on live traffic but not from a pcap file. It probably shows that the issue is not with the TCP reassembly logic, but something with how packets are captured. Maybe there is a packet loss (packets that libpcap drops due to too much traffic or some other reason?). The fact that you see missing bytes can indicate that not all packets are being captured and/or sent to TCP reassembly

from pcapplusplus.