nmap / nmap/npcap

API: pcap_next_ex did not get all the packets that met the requirements

Open
#727 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
3.6k
Forks
592
PR merge metrics
No merged PRs in 30d

Description

I packed 200,000 packets using pcap_sendqueue_queue with a sequence number field added to the packet. Then I use pcap_sendqueue_transmit to send it to another computer in the local area network. The log message printed shows that there were no abnormalities in the delivery process, and the monitoring results in Wiresshark show that the packets were sent normally.
send log:
log1
Wireshark:
screen

Then I use pcap_next_ex to fetch the packet from the local adapter, filter it according to the ip information it was sent, and print the sequence number information in the packet.However, after sorting through the printed information, I found that the packet sequence number was sometimes lost in the middle or at the end.
receive log:
log2

The following is part of the sending and receiving code, is there something wrong with my code?
send:

for (int i = 0; i < pktSize; ++ i){
    ...//header
   
     ...//packet
   
    if (pcap_sendqueue_queue(squeue, pktheader, packet) == -1)
    {
        printf("Warning: packet buffer too small, not all the packets will be sent.\n");
        break;
    }
    npacks++;
}

if ((res = pcap_sendqueue_transmit(outdesc, squeue, sync)) < squeue->len){
printf("An error occurred sending the packets: %s."" Only %d bytes were sent\n", pcap_geterr(outdesc), res);
}
printf("\nTotal packets generated = %d", npacks);

listenToPcap:

while ((res = pcap_next_ex(adhandle, &header, &pkt_data)) >= 0) {
	if (res == 0)
	{
		...
		continue;
	}
	if (res == -1) {
		...
                   return;
	}
	ip_header* ih;
	udp_header* uh;
	u_int srcIndex;
	ih = ...//

	if (xx!= ih->saddr.byte1 || yy != ih->saddr.byte2 ... ...)//The ip filter is the same as in Wireshark
	{
		continue;
	}
	u_int ip_len = (ih->ver_ihl & 0xf) * 4;
	uh = (udp_header*)((u_char*)ih + ip_len);
           //index print
	srcIndex = uh->index;
	printf("%d\n", srcIndex);
	... ....//data
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the shown pcap_sendqueue_queue, pcap_sendqueue_transmit, and pcap_next_ex calls, then compare their return values with the send and receive logs. Check the packet-sequence handling and filtering against the Wireshark capture. Done means reproducing the loss and determining whether it is caused by the caller or by the packet-capture API, with the result documented or corrected.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.