Wireshark · Ethereal-dev: Re: [Ethereal-dev] Dissect a stream

[LEGO <luis.ontanon@xxxxxxxxx>]

you could use tcp_dissect_pdus() decleared in packet-tcp.h

packet-xot.c uses it, but there are plenty more dissectors that use it. 

Luis

On Sun, 27 Feb 2005 15:09:30 +0100, Helge Kruse <HelgeKruse@xxxxxxxxxxx> wrote:
>  
>  
> 
> Hello, 
> 
>   
> 
> I have written a dissector for a UDP based protocol. Now I need to write for
> a TCP based protocol. While I know, that in each packet starts a new packet
> with datagram protocols like UDP, the TCP messages are packed in a stream. I
> fear that the messages are not aligned at packet boundaries, even, if the
> sending process calls a single write for each message. 
> 
>   
> 
> What is the best way to find the start of a new message in a stream? 
> 
> Is there a dissector, that I can use as a sample? 
> 
>   
> 
> I have read README.Developer, but did not find an answer. Sorry, if this is
> a FAQ. 
> 
>   
> 
> Regards, 
> 
> /Helge 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> 
> 
>