2

I want to extract the tcp payload data from tcp packet using pcapplusplus library, or other similar libraries as well. I search documentation but not able to find how to get the tcp payload, but i can get almost anything in the tcp header by using the various api's. How can i get the payload?

Public Member Functions
    TcpLayer (uint8_t *data, size_t dataLen, Layer *prevLayer, Packet *packet)
 
    TcpLayer ()
 
    TcpLayer (uint16_t portSrc, uint16_t portDst)
 
    TcpLayer (const TcpLayer &other)
 
TcpLayer &  operator= (const TcpLayer &other)
 
tcphdr *    getTcpHeader () const
 
uint16_t    getSrcPort () const
 
uint16_t    getDstPort () const
 
TcpOption   getTcpOption (TcpOptionType option) const
 
TcpOption   getFirstTcpOption () const
 
TcpOption   getNextTcpOption (TcpOption &tcpOption) const
 
size_t  getTcpOptionCount () const
 
TcpOption   addTcpOption (const TcpOptionBuilder &optionBuilder)
 
TcpOption   addTcpOptionAfter (const TcpOptionBuilder &optionBuilder, TcpOptionType prevOptionType=TCPOPT_Unknown)
 
bool    removeTcpOption (TcpOptionType optionType)
 
bool    removeAllTcpOptions ()
 
uint16_t    calculateChecksum (bool writeResultToPacket)
 
void    parseNextLayer ()
 
size_t  getHeaderLen () const
 
void    computeCalculateFields ()
 
std::string     toString () const
 
OsiModelLayer   getOsiModelLayer () const

THese are API's to get tcp header data.

rdx
  • 101
  • 1
  • 7

2 Answers2

3

In order to get (any) layer payload you should use the getLayerPayload() API, for example:

pcpp::TcpLayer* tcpLayer = myPacket.getLayerOfType<pcpp::TcpLayer>();
uint8_t* payload = tcpLayer->getLayerPayload();
size_t payloadSize = tcpLayer->getLayerPayloadSize();
seladb
  • 852
  • 1
  • 13
  • 29
1

I got the answer after extensive searching. It is TcpStreamData::getData() method. You can see this link for the API documentation.

rdx
  • 101
  • 1
  • 7
  • no, this is wrong. `TcpStreamData::getData()` is only used in TCP reassembly to get the data stream after performing TCP reassembly – seladb Aug 25 '21 at 08:32