Wireshark · Ethereal-dev: [Ethereal-dev] Dissect a stream

["Helge Kruse" <HelgeKruse@xxxxxxxxxxx>]

Hello,

 

I have written a dissector for a UDP based protocol. Now I need to write for a TCP based protocol. While I know, that in each packet starts a new packet with datagram protocols like UDP, the TCP messages are packed in a stream. I fear that the messages are not aligned at packet boundaries, even, if the sending process calls a single write for each message.

 

What is the best way to find the start of a new message in a stream?

Is there a dissector, that I can use as a sample?

 

I have read README.Developer, but did not find an answer. Sorry, if this is a FAQ.

 

Regards,

/Helge