From f715c06be1dc2b5ed424be987fa3f854cb160852 Mon Sep 17 00:00:00 2001 From: emanuele-f Date: Wed, 26 Jan 2022 15:50:44 +0100 Subject: [PATCH] Disable TPACKET v3 to prevent packets reordering in root mode It seems like TPACKET V3 causes packet reordering issues, where a packet A sent before a packet B by the same host is actually seen after B in the capture. This causes inexistent out-of-order and missing TCP segments issues in Wireshark. This has been verified by comparing the PCAP dump generated by PCAPdroid in HTTP server mode with the traffic dump on the LAN, thus excluding reordering occuring over the Internet. --- app/src/main/jni/pcapd/pcapd.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/app/src/main/jni/pcapd/pcapd.c b/app/src/main/jni/pcapd/pcapd.c index 516fd287..ef4a263e 100644 --- a/app/src/main/jni/pcapd/pcapd.c +++ b/app/src/main/jni/pcapd/pcapd.c @@ -417,7 +417,19 @@ static int open_interface(pcapd_iface_t *iface, pcapd_runtime_t *rt, const char /* The snaplen includes the datalink overhead. Max datalink overhead (SLL2): 20 B */ int snaplen = mtu + SLL2_HDR_LEN; - pcap_t *pd = pcap_open_live(ifname, snaplen, 0, 1, errbuf); + // pcap_set_immediate_mode necessary to avoid using TPACKET v3, which sometimes causes packets + // reordering in the capture + pcap_t *pd; + if(!(pd = pcap_create(ifname, errbuf)) || + pcap_set_immediate_mode(pd, 1) || + pcap_set_snaplen(pd, snaplen) || + pcap_activate(pd)) { + if(pd) { + pcap_close(pd); + pd = NULL; + } + } + if(!pd) { // try to open as file pd = pcap_open_offline(ifname, errbuf);