Kristof Provost wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
I suspect it will be easier if you use the tcp_dissect_pdus() function.
If you can determine the message length without reading the entire
message (you can) that's the recommended approach.
I can determine the *message* length only when i have already
the complete header.
Immagine if I capture a multiple message packet and immagine
it is fragmented in a point after the end of the ultimate
complete message and before the mesageLenght field of the
broken message:
|<-----------------myMsg------------------->|
...|---------+------- -+----+------------+--------+--||---+
...|tcpHeader|5555555 5|0000|mesageLenght|messgeId|details|
...|---------+------- -+----+------------+--------+--||---+
^Fragmentation
I can't understand how much byte I have to take to complete the PDU.
