
Silent packet loss in PcapSplitter: a file collision bug on TCP session reuse
bugTCPnetworkpacket lossfile corruptionPcapPlusPlusPcapSplittersecuritynetworking
A developer discovered a bug in PcapPlusPlus's PcapSplitter tool where TCP session reuse on the same 5-tuple caused silent packet loss and file corruption. The bug occurred because while the splitter correctly assigned new file numbers for reused TCP sessions, the filename function only used IP and port, causing both sessions to write to the same filename and truncate existing data. The developer filed an issue with a 13-connection reproduction case, worked with the maintainer on a fix that adds a suffix on actual collisions, and the fix has been merged.