Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] follow tcp stream algorithm

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Mike Hall <mlh78750@xxxxxxxxx>
Date: Mon, 27 Sep 2004 23:22:49 -0500
On Tue, 28 Sep 2004 00:54:00 +0100, bujecas@xxxxxx <bujecas@xxxxxx> wrote:
> Hello,
> I would like to understand more about the follow tcp stream algorithm of Ethereal.
> I need to do something like that in another application.
> 
> 1st question: Can I reuse the follow tcp stream function from Ethereal? If it's possible, how can I do that?

I wrote the tcp follow code. Well the first cut at it. Many have put
enhancements and bug fixes at this point. You can use the code in
another program as long as that program is also GPL. You cannot take
the code and put it into another project that is not licensed with
GPL. The following link might help.

http://www.ethereal.com/faq.html#q1.4

> 
> 2nd question: I'm thinking to do the tcp stream by checking sequence numbers and ack's. It's a good algorithm? How can I  see a better implementation?

The "how" of reconstructing TCP is well known. I recommend the Stevens
books for a good understanding of TCP and how to develop a robust
algorithm for reconstructing streams or implementing your own TCP/IP
stack.

http://www.amazon.com/exec/obidos/search-handle-url/index=books&field-author=Stevens%2C%252520W.%252520Richard/104-0834251-7466363
Volume 1 and 2 for TCP are both great books.

Good luck,

--Mike