ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] Desegmentation atop TCP problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Peter Johansson <Peter.xc.Johansson@xxxxxxxxxxxx>
Date: Tue, 31 Aug 2004 17:25:22 +0200
Hello!

I have a dissector that is added to handle tcp.port == 14000 which works well until segmented PDUs are received. I read section 2.7 "Reassembly/desegmentation" in the README.developer but cannot seem to get it work the way I want.

When my dissector gets called I do (OCP_HEADER_SIZE = 4):

if(data_length < OCP_HEADER_SIZE)
{
  /* Make sure that the entire OCP header is readable before dissection
     begins */
  pinfo->desegment_offset = data_length;
  pinfo->desegment_len = OCP_HEADER_SIZE - data_length;
  return;
}
else
{
  /* At least the OCP header should be received by now */
  g_assert(data_length >= OCP_HEADER_SIZE);

  ocp_message_length = tvb_get_ntohs(tvb, 0) + OCP_HEADER_SIZE;
/* Make sure that at least one whole OCP PDU is ready for dissection */
  if(data_length != ocp_message_length)
  {
     if(data_length < ocp_message_length)
     {
        /* Too little data for dissection */
        pinfo->desegment_offset = data_length;
        pinfo->desegment_len = ocp_message_length - data_length;
        return;
     }
     else
     {
        /* More than one OCP message exists in the PDU, make sure that
           the next OCP message is dissected later */
        pinfo->desegment_offset = ocp_message_length;
        pinfo->desegment_len = data_length - ocp_message_length;
     }
  }
}


If the data_length was 3 in the first call to the dissector I return that I want 1 additional byte from offset 3 in the next received tvb. This is probably where I have misunderstood something. The next tvb I receive contains the additional bytes that I requested, but only those. Hence the 3 bytes received the first time are now lost. I thought that I should be able to handle the PDU in its entirety. What am I missing?

/ Regards, Peter