Wireshark-dev: Re: [Wireshark-dev] Conversation and TCP reassembly

From: "Jens Steinhauser" <jens.steinhauser@xxxxxxxxxx>
Date: Fri, 1 Aug 2008 10:52:41 +0200

I do the following to create only one conversation per "Configuration
Frame":

  if (config_frame && !pinfo->fd->flags.visited) {
    data = extract_data(...);
    conversation = conversation_new(...);
    conversation_add_proto_data(conversation, proto_handle, data);
  }

An example of what's going wrong:
In the capture I have here, the configuation frame is fragmented into
two TCP segments:
  1460 Bytes in frame #7 and
   864 Bytes in frame #8.

  1460+864 = 2324 = correct length of configuration frame

On the first run or when I comment out the two lines mentioned,
'tcp_dissect_pdus()' calls my get-length-callback for frame 7 and 8,
both times the callback returns '2324', then the routine to dissect the
PDU is called.

But when I create the conversation in the first run and I click on
packet 8 in the packet list, then the get-length-callback is called for
frame 8 with a tvb containing some wrong data, so it extracts and
returns a wrong length (17460 Bytes in this case) -> the dissection
routine isn't called.

Reassembling and dissection for following "Data Frames" is working
correct in both cases.

Any ideas?

Thanks,
Jens

> -----Original Message-----
> From: wireshark-dev-bounces@xxxxxxxxxxxxx 
> [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
> Sent: Thursday, 31. July 2008 19:37
> To: Developer support list for Wireshark
> Subject: Re: [Wireshark-dev] Conversation and TCP reassembly
>  
> Hi,
> 
> Guard creating a new conversation (conversation_new) by first 
> checking if such 
> conversation already exists (find_conversation).
> Then try to get the protocol data before creating and adding 
> a new protocol data 
> structure.
> 
> Thanx,
> Jaap