Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Desegmentation atop TCP problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Wed, 1 Sep 2004 19:14:00 +1000
Ethereal can do almost all of this for you  hiding the ugly details of
the pinfo->desegment_offset et all from you.
The desegmentation API is  tcp_dissect_pdus() in packet-tcp.c


Do a grep for tcp_dissect_pdus in the epan/dissector directory to find
multiple examples on how to use this api.


It is very very easy to use.


In addition to this, it will also, if desegmentation is NOT enabled
still keep track of PDU boundaries so that IF a PDU starts somewhere
in the middle of a segment, ethereal will still know this and where
the next PDU starts.



remember to enable BOTH the tcp preference as well as your own
preference for your protocol to enable desegmentation.


On Tue, 31 Aug 2004 16:26:35 -0500, Jeff Foster  wrote:
> 
> > I have a dissector that is added to handle tcp.port == 14000 which works
> > well until segmented PDUs are received.
> > I read section 2.7 "Reassembly/desegmentation" in the README.developer
> > but cannot seem to get it work the way I want.
> 
> <text deleted/>
> 
> > If the data_length was 3 in the first call to the dissector I return
> > that I want 1 additional byte from offset 3 in the next received tvb.
> > This is probably where I have misunderstood something. The next tvb I
> > receive contains the additional bytes that I requested, but only those.
> > Hence the 3 bytes received the first time are now lost.
> > I thought that I should be able to handle the PDU in its entirety. What >
> > am I missing?
> 
> The pinfo->desegment_offset value is where the next data segment should start.
> So the desegment code will skip over the number of bytes indicated in the offset
> and give the number of bytes in the length.
> 
> If you want those three bytes on the next call you will have to set the offset
> to the beginning of the three byte location.
> 
> This is exactly what I ran into, I wanted to decode the entire PDU in one go so
> I set the desegment_offset to 0 and set the desegment_len to tvb_len + 1.
> 
> Jeff F>
> 
> ***
> The information in this e-mail is confidential and intended solely for the individual or entity to whom it is addressed.  If you have received this e-mail in error, please notify the sender by return e-mail, delete this e-mail, and refrain from any disclosure or action based on the information.
> ***
> 
> 
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>