fabio matturro wrote:
> Let's suppose i have two couple of related packets ( A & A1, B & B1). I
> want to start two different conversations (one when as soon as A is
captured,
> one when B is captured).
So A and B are part of different conversations?
If so, this means that A and A1 are between one pair of endpoints and B
and B1 are between a different pair of endpoints, or that the conversation
that includes A and A1 finishes before the conversation that includes B
and B1 starts, as that's what the notion of a "conversation" at the
transport layer means.
> Now, if the packets are sniffed in this order:
>
> A A1 B B1
...then, if they're between the same endpoint pair, the first conversation
finishes some time between A1 and B, so that could work.
> now, let's consider this scenario (even if improbabile is not impossible)
>
> A B A1 B1
...in which case A and A1, and B and B1, must be between different
endpoint pairs, otherwise that doesn't fit the model of (transport-layer)
conversations and thus the conversation mechanism can't be used.
> When A1 is sniffed the returned conversation is B
If the returned conversation is B for the packet A1, then they must be
between indistinguishable endpoints, and thus the conversation mechanism
has no way of determining to which conversation A1 belongs.
> Are there any other ways of solving this problem?
You could define and implement a notion of a "conversation" different from
the transport-layer end-point oriented notion implemented by the current
conversation code, and use that instead.