end of tcp stream .

Hi all

I'm a java/bv programmer sorry for my lack of Winsock knowledge (and lack
of
good English .)



I had this task to implement a simple sniffer (C code using Winsock )

searching the internet i found relatively simple code , and changed it
successfully according to my needs .



My problem is like that:



I am monitoring data sent over the TCP protocol,

The broadcasting station transmits different sizes of data, the problem I
encountered was when sending 6000 bytes of data.



This data is fragmented into 4 frames 1514 size each, between them I get
ACK frames

So I tried to count on the PUSH flag of TCP , but on the second frame - the
PUSH flag is 1



Professional sniffer shows something like :



1# frame 1514 PUSH = 0

2# frame 1514 PUSH = 1

3# frame 60 ACK

4# frame 60 ACK

5# frame 1514 PUSH = 0

6# frame 1514 PUSH = 1

...





What I'm trying to understand is how do I know when is the end of the TCP
data

How do I know when to stop extracting data from the TCP frames and send the
data to my host application (one level up)



Thank you very much

I will appreciate any help !

Sharon


.

Relevant Pages

  • Re: end of tcp stream .
    ... Well today I understood that inside the TCP data I?m transferring there is ... Then just accumulate the rest of the incoming frames until all data arrives. ... How come PUSH flag is not an indicator? ... >> I uploaded 10 pictures of the sniffer output (commercial sniffer, ...
    (microsoft.public.win32.programmer.networks)
  • Re: end of tcp stream .
    ... > I'm a java/bv programmer sorry for my lack of Winsock knowledge (and lack ... > This data is fragmented into 4 frames 1514 size each, ... > So I tried to count on the PUSH flag of TCP, but on the second frame - ...
    (microsoft.public.win32.programmer.networks)
  • RE: suffering from an apparently broken tcp
    ... suffering from an apparently broken tcp ... that outgoing packets had a checksum error at the TCP layer. ... Most of the time three TCP continuation frames come in back-to-back, ... it's only on the local network that's dreadfully slow. ...
    (Debian-User)
  • RE: suffering from an apparently broken tcp
    ... I'm really starting to convince myself that this is a hardware ... that outgoing packets had a checksum error at the TCP layer. ... Most of the time three TCP continuation frames come in back-to-back, ... it's only on the local network that's dreadfully slow. ...
    (Debian-User)
  • Re: end of tcp stream .
    ... with IP-level fragmentation which will not happen in a normal TCP stream. ... The sender opens a TCP connection, sends data, waits for a response ... >> This data is fragmented into 4 frames 1514 size each, ...
    (microsoft.public.win32.programmer.networks)