I'm trying to capture packets and reorganize packets for obtaining original HTTP request.
I'm capturing packets by IPQUEUE(by iptables rule), and I figured out that packets are not captured in order.
I already know that in TCP protocol, packets have to be re-sequenced, so I'm trying to re-sequence packets by sequence number.
According to Wikipedia, the sequence number of TCP is 32 bits number. Then, what happens if sequence number reaches to MAX 32bits number?
Because sequence number of SYN packet is random number, I think this limitation can be reached very fast.
If anybody has a commend on it, or has some links helpful, please leave me a answer.
From RFC-1185
Avoiding reuse of sequence numbers within the same connection is
simple in principle: enforce a segment lifetime shorter than the
time it takes to cycle the sequence space, whose size is
effectively 2**31.
If the maximum effective bandwidth at which TCP
is able to transmit over a particular path is B bytes per second,
then the following constraint must be satisfied for error-free
operation:
2**31 / B > MSL (secs)
So In simpler words TCP will take care of it. In addition of this condition TCP also has concept of Timestamps to handle sequence number wrap around condition. From the same above RFC
Timestamps carried from sender to receiver in TCP Echo options can
also be used to prevent data corruption caused by sequence number
wrap-around, as this section describes.
Specifically TCP uses PAWS mechanism to handle TCP wrap around case. You can find more information about PAWS in RFC-1323
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With