1

I am writing an application that needs to get access to TCP header fields, for example, a sequence number or a TCP timestamp field.

Is it possible to get sequence numbers (or other header fields) by operating at the socket API without listening on a raw socket? (I want to avoid filtering out all the packets).

I am looking at the TCP_INFO but it has a limited information.

For example, after calling a recvmsg() and getting a data buffer, is it possible to know the sequence number of the segment that delivered the last byte in that received data buffer?

Thanks

kirbo
  • 1,707
  • 5
  • 26
  • 32

1 Answers1

2

You can try to use libpcap to capture packets. This lib allows to specify packet filter using the same syntax as in Wireshark, so you could limit captured packets to one connection only. One downside is that you would have to receive packets in normal way too, what complicated things a bit and is an additional performance overhead.

Update: you can also open raw socket and set Berkeley Packet Filter on it using socket option SO_ATTACH_FILTER. More details are here: https://www.kernel.org/doc/Documentation/networking/filter.txt . However you would have to implement TCP part of IP stack in your code too.

Daniel Frużyński
  • 2,091
  • 19
  • 28