Can libpcap reassemble TCP segments

Question

I need to sniff TCP traffic into my application.

Can libpcap reassemble TCP segments or I have to do it manually?

The home page says "Full documentation is provided with the source packages in man page format". After I sudo apt-get install libpcap-dev I only find one man pcap. Is it all the documentation available or I simply missed something?

Thanks

Answer 1

Packet or stream reassembly is not mentioned in pcap(3).

If I remember correctly, the dsniff tools use libnids to reassemble IP packets and TCP streams.

Answer 2

Three years ago I used libpcap and I had to reassemble TCP streams myself, it's not very difficult but it's full of corner cases.

You may look at wireshark dissectors and «follow TCP stream» option if license (GPLv2) is ok for your project.