Re: end of tcp stream .

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Getting a TCP FIN or RST flag is the end of the connection.
Not sure if that's what you wanted, as you probably don't want
to buffer the entire TCP conversation before processing - it
may be in the order of megabytes or even gigabytes...

--
=====================================
Alexander Nickolov
Microsoft MVP [VC], MCSD
email: agnickolov@xxxxxxxx
MVP VC FAQ: http://www.mvps.org/vcfaq
=====================================

"Sharon" <Sharon669@xxxxxxxxxxx> wrote in message
news:OnOv7h2kFHA.3828@xxxxxxxxxxxxxxxxxxxxxxx
> Hi all
>
> I'm a java/bv programmer sorry for my lack of Winsock knowledge (and lack
> of
> good English .)
>
>
>
> I had this task to implement a simple sniffer (C code using Winsock )
>
> searching the internet i found relatively simple code , and changed it
> successfully according to my needs .
>
>
>
> My problem is like that:
>
>
>
> I am monitoring data sent over the TCP protocol,
>
> The broadcasting station transmits different sizes of data, the problem I
> encountered was when sending 6000 bytes of data.
>
>
>
> This data is fragmented into 4 frames 1514 size each, between them I get
> ACK frames
>
> So I tried to count on the PUSH flag of TCP , but on the second frame -
> the
> PUSH flag is 1
>
>
>
> Professional sniffer shows something like :
>
>
>
> 1# frame 1514 PUSH = 0
>
> 2# frame 1514 PUSH = 1
>
> 3# frame 60 ACK
>
> 4# frame 60 ACK
>
> 5# frame 1514 PUSH = 0
>
> 6# frame 1514 PUSH = 1
>
> ..
>
>
>
>
>
> What I'm trying to understand is how do I know when is the end of the TCP
> data
>
> How do I know when to stop extracting data from the TCP frames and send
> the
> data to my host application (one level up)
>
>
>
> Thank you very much
>
> I will appreciate any help !
>
> Sharon
>


.

Relevant Pages

  • Re: end of tcp stream .
    ... The TCP PSH flag is not used by modern TCP stacks. ... > In the 5 first pictures you can see the 5 frames I'm trying to assemble, ... > The PUSH flag is 0 in all frames except of the last one, ...
    (microsoft.public.win32.programmer.networks)
  • RE: suffering from an apparently broken tcp
    ... suffering from an apparently broken tcp ... that outgoing packets had a checksum error at the TCP layer. ... Most of the time three TCP continuation frames come in back-to-back, ... it's only on the local network that's dreadfully slow. ...
    (Debian-User)
  • Re: end of tcp stream .
    ... > I'm a java/bv programmer sorry for my lack of Winsock knowledge (and lack ... > This data is fragmented into 4 frames 1514 size each, ... > So I tried to count on the PUSH flag of TCP, but on the second frame - ...
    (microsoft.public.win32.programmer.networks)
  • RE: suffering from an apparently broken tcp
    ... I'm really starting to convince myself that this is a hardware ... that outgoing packets had a checksum error at the TCP layer. ... Most of the time three TCP continuation frames come in back-to-back, ... it's only on the local network that's dreadfully slow. ...
    (Debian-User)
  • Re: Problem with writing fast UDP server
    ... it likely means you have reached your ethernet bandwidth ... frames) to achieve your desired results. ... Keep in mind TCP is stream based, not datagram based so you may need ... On your client, make the following changes. ...
    (comp.lang.python)