Click here to Skip to main content
15,443,549 members
Please Sign up or sign in to vote.
4.50/5 (2 votes)
See more:
I am now developing a project using Winpcap.. I know that packets being sniffed are usually fragmented packets.

How can I reassemble these TCP fragments?.. Are any ideas, suggestions, or tutorials available?

I am assuming this to be the only way I can view the HTTP header...

Updated 14-Feb-10 5:48am

1 solution

All the TCP packets contain TCP sequence number. To re-assemble the data, you just need to start at the Initial sequence number packet and going from lowest to highest sequence number

TCP header structure[^]

TCP initial sequence number[^]
Share this answer

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900