Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: RE: [Ethereal-dev] Desegmentation atop TCP problem / TCP reassembly and desegmen

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Jeff Foster" <jfoste@xxxxxxxxxxxx>
Date: Wed, 1 Sep 2004 08:58:11 -0500

From: ronnie sahlberg 
Sent: Wednesday, September 01, 2004 6:42 AM

> On Wed, 1 Sep 2004 06:06:18 -0500, Jeff Foster <jfoste@xxxxxxxxxxxx> wrote:
> > 
> > This will work for a fixed length PDU, which does seem to be Peter's
> > situation, or a PDU with a length value in the start of the PDU.
> > Though I found to documentation in README.developer to be somewhat
> > confusing. A simpler example that handles only TCP data may help here.
> > 
> > In my situation I don't know the PDU length because it contains null
> > terminated strings. I wanted to decode the entire PDU so I return a
> > pinfo->desegment_offset of zero with pinfo->desegment_len = tvb_len()+1.
> > As I stated before, in the email 'TCP reassembly and desegment_offset = 0'
> > I never see a second call to the sub_dissector by the TCP desegment code.
> 
> pinfo->desegment_len = tvb_len()+1   is probably the problem.
> desegment_len takes the number of bytes BEYOND the end of this segment
> we need,   so try
> pinfo->desegment_len = 1
> instead.
> This will cause ethereal to reassemble this this segment with at least
> 1 more byte, i.e. the entirety of the next segment in the sequence
> number space.

Thanks, that was exactly the problem. It seems a little obtuse to set the
desegment_len = 1 when the desegment_offset is 0.  The doc's should make it
clear enough that desegment_len is the additional data required and not related
to the value in desegment_offset. I was assuming that I specified the data 
offset and the amount of data required.

I don't like that I have to manipulate the pinfo structures directly to 
request the desegmentation. I would rather call a function to request the
data so the details are hidden from me and changes to the desegmentation
code don't impact my code. I would like to see a function i.e.
desegment_request_data( pinfo, offset, length); that would make the changes
to the pinfo->desegment_len and pinfo->dsegment_offset. 

Jeff F>

 


***
The information in this e-mail is confidential and intended solely for the individual or entity to whom it is addressed.  If you have received this e-mail in error, please notify the sender by return e-mail, delete this e-mail, and refrain from any disclosure or action based on the information.
***