| Subject: | Doesn't detect FIN packets with data |
| Date: | Fri, 20 Oct 2006 13:46:54 +0100 |
| To: | bug-Net-Analysis [...] rt.cpan.org |
| From: | David Pashley <david [...] davidpashley.com> |
TCPSession doesn't detect the case where the final packet with data also
contains a FIN flag. It assumes the length of the data is 0, so gets the
sequence number wrong. This patch fixes this problem.
--- /usr/share/perl5/Net/Analysis/TCPSession.pm 2006-10-20 04:08:12.000000000 +0100
+++ /home/david/Net-Analysis-0.05/lib/Net/Analysis/TCPSession.pm 2006-09-02 15:53:02.000000000 +0100
@@ -250,7 +248,7 @@
# Open a new SYN/FIN (or discard)
if (! exists ($h->{$pkt->{seqnum}})) {
$self->_trace ("-- update_status: new SYN/FIN : $pkt");
- $h->{$pkt->{seqnum}+ length $pkt->{data}} = $pkt;
+ $h->{$pkt->{seqnum}} = $pkt;
} else {
$self->_trace ("-- update_status: dup SYN/FIN : $pkt");
}
--
David Pashley
david@davidpashley.com
Nihil curo de ista tua stulta superstitione.