TCP stream reassembly about hadoop-pcap HOT 3 CLOSED

@mrrrgn has already started work on a prototype in Python for this (https://github.com/mrrrgn/hive-tcp-stream-prototype).

from hadoop-pcap.

It's important for the implementation to remember that a TCP session might be long lived. As many people will use this library to decode multiple PCAP files such a session might span multiple files. In a MapReduce environment different files might be processed by different systems without any way to sync them.

It might be a good idea to implement a stub MapReduce job that ppl can extend from that maps every packet based on it's destination IP and then in the reduce phase performs the stream reassembly.

from hadoop-pcap.

A good run down of a TCP stream and how SEQ/ACK works can be found here: http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/

from hadoop-pcap.