Comment 11 for bug 192174

Revision history for this message
binary.koala (binary-koala) wrote :

indeed looks like we need similar functionality, and probably not only us.
i looked into the source of tcpip.c and it is obvious that print_packet() function doesn't take any care of stream ordering:

void print_packet(flow_t flow, const u_char *data, u_int32_t length)
{
  printf("%s: ", flow_filename(flow));
  fwrite(data, length, 1, stdout);
  putchar('\n');
  fflush(stdout);
}

we would need some sort of locking/buffering mechanism here that would wait/buffer streams and print them out sequentially.

as i cannot rewrite in myself, i guess for now i will use dump files with iwatch to run foremost against every new session file that i get from tcpflow.