Stream Reassembly
Definition
The process of collecting all the TCP segments belonging to a single connection and reordering them by sequence number to reconstruct the complete application-layer payload. Required because TCP segments may arrive out of order or be fragmented across multiple packets.
- Input
- Captured TCP segments
- Ordering key
- TCP sequence number
- Output
- Reconstructed application payload
- Needed because
- Segments can arrive out of order
Common questions
Why can't an investigator just read packets in capture order?+
Routing and retransmission mean packets belonging to one connection can arrive at the capture point out of sequence or split across multiple frames, so reading them in arrival order can scramble or truncate the actual file, message, or web page being reconstructed.
What tools perform stream reassembly during an investigation?+
Packet analysis tools such as Wireshark's Follow TCP Stream feature and dedicated carving utilities like tcpflow reorder captured segments by sequence number and strip the transport headers to expose the original application-layer content.
Related terms
- Artefact Carving
- Extracting embedded content from raw data by locating known file signatures (magic bytes) at byte boundaries. In PCAP analysis, this means reassembling...
- Beaconing
- Periodic outbound connections from a compromised host to a command-and-control server, typically at regular intervals. The regularity of the interval, measured in...
- Display Filter
- A Wireshark filter expression applied to an already-captured PCAP file to show only packets matching specified criteria. Display filters do not delete...
- PCAP
- Packet capture file. The standard format for storing captured network frames, originally defined by the libpcap library. Each record contains the raw...
- Protocol Dissector
- A software component in a packet analyser that recognises a specific protocol and parses its header fields into named, readable values. Wireshark...