On Tuesday, July 8, 2003, at 5:52 AM, Biot Olivier wrote:
I can rely upon the value of smpp.source_addr and
smpp.destination_addr in
order to identify fragments that are potentially part of the same
message. I
can create conversations based on smpp.source_addr and
smpp.destination_addr
(both are NULL-terminated text strings that represent an endpoint's
"phone
number") addresses (address.type = AT_NONE). The question is whether I
can
reassemble Short Message fragments which are spread across distinct
SMPP/TCP
connections. To summarize:
TCP conversation t1 (SMPP conversation s1): SMS fragment 1/2 (smf1)
TCP conversation t2 (SMPP conversation s1): SMS fragment 2/2 (smf2)
==> How can I reassemble smf1 and smf2
Well, if you set "pinfo->src" and "pinfo->dst" to point to the source
and destination address structures, and set "pinfo->srcport" and
"pinfo->dstport" to 0 (unless there's some notion of ports that
distinguish multiple endpoints on the phones), the reassembly code
should be able to reassemble based on those addresses.
You should probably save them and restore them in case any other
dissector uses them. (This argues that perhaps there should be
*stacks* of addresses and ports and the like. It also raises the
question of whether there should be a general way, if we have those
stacks, to control which level of the stack should have its addresses
displayed in the summary; I suspect the answer to that question is
"yes".)
There is also the potential risk of another dissector also using
AT_NONE addresses in that fashion; perhaps we should have a mechanism
by which dissectors can register address and/or port types, along with
code to display their values.
