Hi Ryan:

TCPFlow did not support IP Fragmentation (atleast until the last version
that I checked). Try coding your own using the fine libNIDS. I do have an
reference implementation that also handles IP Fragmentation based on libnids
for Win32, but I'm quite sure whether that can be shared open-source.
However, if you attempt to reserach libnids you'll find that it is quite
trival to write a TCP Stream Re-assembly software (the engine is < 23 lines
of code ;))

Regards,
Raghav

Ryan Wrote:

Any recommendations for which tools are best for extracting a binary file
from a group of TCP packets, preferrably in tcpdump format? I'm just
about to try tcpflow:
http://www.circlemud.org/~jelson/software/tcpflow/
But I'd also like to hear from others on what tools they have tried, and
what the various strengths and weaknesses are.

                                        Ryan

---------------------------------------------------------------------
To unsubscribe, e-mail: honeypots-unsubscribesecurityfocus.com
For additional commands, e-mail: honeypots-helpsecurityfocus.com
---------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert
(SIA) Service. For more information on SecurityFocus' SIA service
which automatically alerts you to the latest security vulnerabilities.
Please, see: https://alerts.securityfocus.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]