From 568946ec1822fcf8058f5f90ab3ea8aba08b16f2 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Mon, 22 May 2023 13:54:07 +0200 Subject: [PATCH] IP: Update packet->len with accumulated fragment size With packet->len representing the wire length and other places relying on it, ensure it's updated for fragments as well. This assumes non-truncated fragments right now. Otherwise we'd need to teach the FragmentReassembler to somehow track this independently but it would be a mess. --- src/packet_analysis/protocol/ip/IP.cc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/packet_analysis/protocol/ip/IP.cc b/src/packet_analysis/protocol/ip/IP.cc index b875a066da..1803122c27 100644 --- a/src/packet_analysis/protocol/ip/IP.cc +++ b/src/packet_analysis/protocol/ip/IP.cc @@ -205,6 +205,8 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) } packet->cap_len = total_len + hdr_size; + // Assumes reassembled packet has wire length == capture length. + packet->len = packet->cap_len; } }