Wireshark · Ethereal-dev: Re: [Ethereal-dev] displaying multiple pdu's in one packet as multiple packets for summary window

[Ulf Lamping <ulf.lamping@xxxxxx>]

Durnford, Robin (EXP) wrote:
> I have been writing a dissector and recently implemented the tcp_dissect_pdus function when I noticed some of my messages were longer than the length field. 
> The pdu dissection works great except that you have to select the message with multiple pdus in the summary before you notice there are multiple pdus in the packet.
> To tcp these packets look like one message and are therefore one row in the summary window, but to the people who will be using the dissector and looking for a particular message at a glance these pdus are actually 2 or more different messages. 
>
>   
That's a common problem. For example, I've seen up to 12! DCE/RPC 
requests in a single TCP packet.

The solution I've implemented is to "show" this in the Info column.

I've found the set_fence() function may help in this regard (can't 
remember the exact function name), it prevents the info column from 
being cleared at the beginning of the dissector (as your dissector will 
be called more than once).

Regards, ULFL
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev