internal bool TryAppendNextPacket()
{
int maxPacketFragments = 6;//this one is set low in order to get better performance
if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.NetBiosSessionService)
{
maxPacketFragments = 50;//Changed 2011-04-25
}
else if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Http)
{
maxPacketFragments = 32;//Changed 2011-10-12 to handle AOL webmail
}
else if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Smtp)
{
maxPacketFragments = 61;//Changed 2014-04-07to handle short manual SMTP emails, such as when sending via Telnet (Example: M57 net-2009-11-16-09:24.pcap)
}
if (tcpDataStream.CountBytesToRead() > this.ByteCount && tcpDataStream.CountPacketsToRead() > nPackets && nPackets < maxPacketFragments)
{
nPackets++;
return(true);//everything went just fine
}
else
{
return(false);
}
}
internal bool TryAppendNextPacket()
{
int maxPacketFragments = 6;//this one is set low in order to get better performance
if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Ssl)
{
maxPacketFragments = 15; //TLS records are max 16kB, each frame is about 1500 B, 15 frames should be enough (famous last words)
}
if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.NetBiosSessionService)
{
maxPacketFragments = 50;//Changed 2011-04-25
}
else if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Http)
{
maxPacketFragments = 32;//Changed 2011-10-12 to handle AOL webmail
}
else if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Smtp)
{
maxPacketFragments = 61;//Changed 2014-04-07to handle short manual SMTP emails, such as when sending via Telnet (Example: M57 net-2009-11-16-09:24.pcap)
}
else if (this.tcpDataStream.session.protocolFinder.GetConfirmedApplicationLayerProtocol() == ApplicationLayerProtocol.Http2)
{
maxPacketFragments = 22;//Most HTTP/2 sessions use chunks up to 16384 bytes
}
if (tcpDataStream.CountBytesToRead() > this.ByteCount && tcpDataStream.CountPacketsToRead() > nPackets && nPackets < maxPacketFragments)
{
nPackets++;
return(true);//everything went just fine
}
else
{
return(false);
}
}