Wireshark · Ethereal-dev: Re: [Ethereal-dev] IP over fixed-length frames

["Guy Harris" <gharris@xxxxxxxxx>]

Joshua Schoolcraft said:
> Scenario #1: The size of the IP packet exceeds the size of the CCSDS
> transfer frame.
> In this case, there will exist telemetry transfer frames which contain
> no IP header and only a partial IP payload, or contain an IP header
> with a partial payload, padded by a preceding fragmented payload.

> The transfer frame header contains a pointer to the first IP header in
> its payload (if it exists), so I can at least reliably find a single
> IP header in the mix.  Is there any way, however, to decode the IP
> payload when it spans across multiple CCSDS frames?

Yes, *if* you reassemble the pieces of the IP datagram.

> Scenario #2: The size of the IP packet is small enough that multiple
> packets will fit in a single frame.  In this case, I can use the
> previously mentioned pointer to pass Ethereal the first IP packet, but
> I'm not sure how to make it dissect each additional one inside the
> frame's payload.

Have a loop in the CCSDS dissector, which calls the IP dissector for each
IP datagram, passing it a tvbuff that contains only the data for that IP
datagram.

Without a spec for that protocol and for the way IP datagrams are
encapsulated within it, I can't give full details on how this would be
done, as I don't know how you'd know where the IP datagram boundaries are.
 Are those specs available?