Wireshark · Ethereal-dev: Re: [Ethereal-dev] Submission of a dissector for the IBM WebSphere MQ protocol v1.11

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Mar 24, 2004 at 08:54:50PM +0100, metatech wrote:
> In the mean time I have made a few enhancements to my dissector, namely the 
> heuristic detection now fully works.  In the previous version, a PDU that 
> was spun amongst two Ethernet frames was not recognised at all.

Checked in.

> I hope I can integrate the desegmentation mode for the next version,

If the length is the iSegmentLength field, then the "fixed_len" argument
to "tcp_dissect_pdus()" should be 8 (that field appears to start at an
offset of 4 and be 4 bytes long) and the "get_pdu_len()" routine would
look something like

	static guint
	get_mq_pdu_len(tvbuff_t *tvb, int offset)
	{
		return tvb_get_ntohl(tvb, offset + 4);
	}

if the length is the *total* length of the MQ packet *including* the
header.  If it's not the total length, you'd have to compute the total
length from that field - you should probably also check to make sure
that the total length isn't *less* than the length in the field, which
could happen with a bogus or very large length field (overflow).