since this seems to be a work in progress i wont check the patch in yet?
The fragmentation is not doen at the UDP layer. It occurs in the IP layer.
See the preferences for IP there you can enable reassembly of IP PDUs.
heuristic tcp dissectors :
grep heur_dissector_add *.c | grep tcp
see for example packet-tuxedo.c that both uses heuristics but also
creates a conversation to remember which tcp sessions were tuxedo
On Fri, 04 Mar 2005 21:38:21 -0800, Michael Duigou <ethereal@xxxxxxxxxx> wrote:
> Yep, the previous patch isn't yet applied and already here's another
> version. Adds fancier dissection of message namespaces and element flags.
>
> I've also got a couple of questions:
>
> For fragmented UDP Messages I can't find a preference to reassemble the
> whole UDP message before it is passed to the dissector. How do I enable
> reassembly of UDP fragments?
>
> Can anyone point me at a good sample for a heuristic tcp dissector? I'd
> like to add dissection of TCP streams, but am wondering how to "claim" a
> tcp stream which begins with JXTA's signature value. I've currently got
> a global preference for port numbers, but JXTA generally doesn't use
> fixed ports so I'd prefer to do it heuristically.
>
> I'm also looking for a sample of dissection of a protocol which is
> running ontop of HTTP.
>
> Mike
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>
>
>
