Decode problem with IP fragments

[felipeaf]

I've observed that ip fragments are decoded with wrong values in transport layer are only in the first fragment. Although, for UDP, the first fragment show correct values for ports and length, but the data buffer is still wrong, because the length of header is used for decode, but that is bigger than the size of that part of payload.

I think the correct approach to handle with fragments is preserve the full IP payload as raw data (Buffer), so the user would be able to reassembly the original unfragmented packet, what is not possible with the actual result.

For the first fragment, i think is usefull both, decode the next header and to have the buffer for reassembly algorithms.

I'm working now in solve this question and write a reassembly algorithm.

[felipeaf]

To check this problem, get the file http://packetlife.net/captures/icmp%20fragmented.cap
There are only 7 icmp echo replies in this file, and no more things. But each reply are fragmented in 11 parts.

Now pass as argument to the script below. You will see a lot of fakes icmp packets. The only valids are that which type and code are zero.

'use strict';
var fs = require('fs');
var pcap = require('../pcap');

var filename = process.argv[2]; 
var pcap_session = pcap.createOfflineSession(filename, '');

function findIPv4Packet(pcapPacket) {
    if(pcapPacket.link_type === 'LINKTYPE_RAW') {
        return pcapPacket.payload;
    }

    if(pcapPacket.link_type ===  'LINKTYPE_ETHERNET') {
        var packetEthernet = pcapPacket.payload;
        if(packetEthernet.ethertype === 2048) {
            return packetEthernet.payload;
        }
    }
    //TODO LINKTYPE_NULL
    return null;
}

var packetCount = 0;
pcap_session.on('packet', function filterDecodePacket(rawPacket) {
    var packet = pcap.decode.packet(rawPacket);
    var iPPacket = findIPv4Packet(packet);
    console.log(packetCount++);
    console.log(iPPacket.payload);
});