Wireshark · Ethereal-dev: Re: [Ethereal-dev] displaying multiple pdu's in one packet as multiple packets for summary window

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Ulf Lamping wrote:
> Durnford, Robin (EXP) wrote:
> > I have been writing a dissector and recently implemented the 
> > tcp_dissect_pdus function when I noticed some of my messages were 
> > longer than the length field. The pdu dissection works great except 
> > that you have to select the message with multiple pdus in the summary 
> > before you notice there are multiple pdus in the packet.
> > To tcp these packets look like one message and are therefore one row 
> > in the summary window, but to the people who will be using the 
> > dissector and looking for a particular message at a glance these pdus 
> > are actually 2 or more different messages.
> >   
> That's a common problem. For example, I've seen up to 12! DCE/RPC 
> requests in a single TCP packet.

Just two days ago I was looking at an M3UA/SCTP trace with *35* (M3UA) 
DAUD messages bundled into a single packet.

> The solution I've implemented is to "show" this in the Info column.

That works up to a point (that point being when the Info column is so 
long it scrolls off the right of the screen!).  I think, though, that 
having some way of viewing the payload PDUs separately would be useful. 
 I just haven't thought of how that could be done.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev