ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] Questions about Reassembly

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Gehnen, Gerrit" <G.Gehnen@xxxxxxxx>
Date: Thu, 18 Sep 2003 09:46:56 +0100
Hello list,

currently I'm writing a plugin for a protocol under development, which
needs heavy reassembly.

It is based on raw ethernet, so no IP, OSI or other drivers can help me
in the reassembly.
The datagrams are usually pretty short (1-3 bytes) and in most cases I know
with the
first byte received the length of the telegram. But there can be
messages with an arbitrary length (16k are no problem....)
Since the protocol is a basically a wrapper for an old style serial
protocol,
should use most of existing implementations it is possible, that every
byte of the datagrams are packed into a seperate ethernet packet.
Don't complain about the overhead - I didn't invent the protocol, and 
I'm not very happy about it, too.

The problem:
In most cases I have no information, if the (single) byte in a packet 
is the last one of the datagram, or the offset in the datagram.
I don't have a sequence number. 
I know from the first byte of the datagram the length in bytes of the
datagram.
But: 
- fragment_add_check() needs the offset of the data in the datagram.
  I don't know this.
- for fragment_add_seq_next() you can specify the length of the datagram in
  number of packets (FD_BLOCKSEQUENCE), but not the length in bytes.

Sure, the protocol has some design flaws here, but it's my intention to 
expose these flaws with this plugin.

I'm searching some type of fragment_add__next() call, which adds packets to 
the hash table in their incoming order and uses preset total length
information
in bytes for the datagrams.
Is this still to implement?

  Gerrit