Packets Reassembly

pcapkit.foundation.reassembly bases on algorithms described in RFC 791 and RFC 815, implements datagram reassembly of IP and TCP packets.

See also

For more information on customisation and extension, please refer to Customisation & Extensions.

• Base Class
  • Internal Definitions
  • Type Variables
• IP Datagram Reassembly
  • Base Class
  • IPv4 Datagram Reassembly
  • IPv6 Datagram Reassembly
  • Algorithm
• TCP Datagram Reassembly
  • Algorithm
  • Terminology
  • Data Models
  • Type Variables

All reassembly classes are implemented as ReassemblyBase subclasses, which are responsible for processing extracted packets and reassemble the datagrams to a nonfragmented packet. Below is a brief diagram of the class hierarchy of pcapkit.foundation.reassembly:

        flowchart LR
    A{{ReassemblyMeta}} -.->|metaclass| B(ReassemblyBase)

    B --> IP & TCP
    IP --> IPv4 & IPv6

    B --> C(Reassembly)
    C --> D([user customisation ...])

    click A "reassembly.html#pcapkit.foundation.reassembly.reassembly.ReassemblyMeta"
    click B "reassembly.html#pcapkit.foundation.reassembly.reassembly.ReassemblyBase"
    click C "reassembly.html#pcapkit.foundation.reassembly.reassembly.Reassembly"
    click D "../../../ext.html#reassembly-and-flow-tracing"

    click IP "ip/ip.html#pcapkit.foundation.reassembly.ip.IP"
    click IPv4 "ip/ipv4.html#pcapkit.foundation.reassembly.ipv4.IPv4"
    click IPv6 "ip/ipv6.html#pcapkit.foundation.reassembly.ipv6.IPv6"
    click TCP "tcp.html#pcapkit.foundation.reassembly.tcp.TCP"
    

Auxiliary Data

class pcapkit.foundation.reassembly.ReassemblyManager(*args: VT, **kwargs: VT)

Bases: Info

Reassembly Manager.

ipv4: IPv4

IPv4 reassembly.

ipv6: IPv6

IPv6 reassembly.

tcp: TCP

TCP reassembly.

class pcapkit.foundation.reassembly.data.data.ReassemblyData(*args: VT, **kwargs: VT)

Bases: Info

Data storage for reassembly.

ipv4: tuple[Datagram, ...]

IPv4 reassembled data.

ipv6: tuple[Datagram, ...]

IPv6 reassembled data.

tcp: tuple[Datagram, ...]

TCP reassembled data.

class pcapkit.foundation.reassembly.data.data.Deferred(analyze, proto, payload)

Bases: object

A postponed analysis of a reassembled payload.

A reassembled datagram’s packet is a second, full parse of the payload the datagram just reassembled. Nothing about postponing it is specific to any one reassembler, which is why this lives beside ReassemblyData rather than in either protocol’s data module.

IP reassembly is the case that made it necessary. It submits a datagram for every frame – not only the fragmented ones, since a frame that is not fragmented in any sense still reaches IP.reassembly and is submitted there as a trivially complete datagram – so an eager parse would re-parse captures holding no fragments at all: http.pcap has 1117 IPv4 frames, none of them fragmented, and the eager parse measured 86% of the cost of IP reassembly over it.

TCP reassembly defers its packet as well (TCP.submit), at a far smaller saving, being FIN/RST-driven rather than per-frame – 222 submits per http.pcap pass against 1117.

Holding the call here defers it to the first read of Datagram.packet, where DeferredPacket runs it, so a caller that wants the parsed payload still gets exactly the object an eager call would produce, and one that does not never pays for it.

Parameters:

• analyze (Callable[[TransType, bytes], ProtocolBase]) – The analyser to call, i.e. Protocol.analyze bound to the reassembly object’s protocol.

• proto (TransType) – Payload protocol type.

• payload (bytes) – Reassembled payload to parse.

Added in version 1.5.0.

__call__()

Run the postponed analysis.

Return type:

ProtocolBase

Returns:

Parsed payload.