Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Dissect multiple PDUs in one TCP Segment

From: Robert Naumann <robert.naumann@xxxxxxxxxxxxxxxxxxxx>
Date: Wed, 23 May 2007 17:07:40 +0200
Hello,

i'm new to the dissector developement for wireshark. I've read that it should be actually possible to dissect multiple PDUs from one TCP Segment with tcp_dissect_pdus(), but i don't get it working.

For example: i've got 2 different PDUs with different lengths (5 and 6). I already got the pdu lengths. The Length of the TCP Datasegment is 11.

So for the first PDU the function:

tcp_dissect_pdus(tvb, pinfo, tree, TRUE, min_pdu_size, *first_pdu_size*, dissect_pdu_sc);

so the first PDU with the correct size (proved) should be passed to the dissector function dissect_pdu_sc.

My first problem: ============= At the dissection of my top level protocol the PDU is marked as [Malformed Packet], why? Size is correct! bitstream show the complete data of my PDU

My second problem: =============== The second PDU within the the TCP Segment wont be dissected and not shown as a part of my top level protocol. Is the second PDU automatically processed or do i have to call the function tcp_dissect_pdus() again?

Any suggestion would be nice,

Thanks, Robert