Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] behavior of tcp_dissect_pdus when protocol pdu is across tcp

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 24 Aug 2009 17:37:48 -0700

On Aug 24, 2009, at 11:02 AM, Sudarshan Raghavan wrote:

How do I make tcp_dissect_pdus work correctly with chunks across TCP segments.

Is it not working correctly now? I've seen it work correctly for other protocols, even with multiple messages within one TCP segment, messages split across TCP segments, and messages split across TCP segments with the last TCP segment having the end of one message followed by other messages or the beginning of another message.

Note that "working correctly" does not mean "calling your dissector with a non-zero offset", it means "calling your chunk dissector with a completely reassembled RTMP chunk, even if the chunk is split across TCP segment boundaries or if there are parts of more than one RTMP chunk (or complete RTMP chunks) in a TCP segment".