-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
I suspect it will be easier if you use the tcp_dissect_pdus() function.
If you can determine the message length without reading the entire
message (you can) that's the recommended approach.
See the README.developer file.
Disclaimer: I'm not a wireshark developer, I may be wrong.
Kristof
> Hi list,
> I'm fighting with tcp reassembling but i have always some
> problem. i have to dissect a protocol composed by different
> messages. Each message had a fixed size header (from 55555555
> to messgeId) and in mesageLenght there is the length of the
> messages.
>
> |<-----------------myMsg------------------->|
> |---------+--------+----+------------+--------+--||---+
> |tcpHeader|55555555|0000|mesageLenght|messgeId|details|
> |---------+--------+----+------------+--------+--||---+
>
> In each packet captured by wireshark i can find more of this
> messages and the last messages in the packet's payload
> (can be a single long message as well) can be interrupted
> in avary point by packets fragmentation.
>
>
> I wrote a dissector in the following manner:
>
> __________________________________________________
> if (((gint)(tvb->length)) < 20)
> {
>
> pinfo->desegment_offset = 0;
> pinfo->desegment_len = -1;
> return -1;
>
> }
> else
>
> {
>
> fmessageHead = (guint32)get_k_byte_from_n(tvb, 0, 4);
>
> messageId = (guint32)get_k_byte_from_n(tvb, 4, 4);
>
> messageChecksum = (guint32)get_k_byte_from_n(tvb, 8, 4);
>
> reservedBytes = (guint32)get_k_byte_from_n(tvb, 12, 4);
>
> messageLength = (guint16)get_k_byte_from_n(tvb, 16, 2);
>
> message = (guint16)get_k_byte_from_n(tvb, 18, 2);
>
>
>
> if (((gint)(tvb->length)) < (18 + messageLength))
>
> {
>
> pinfo->desegment_offset = 0;
>
> pinfo->desegment_len = -1;
>
> return -1;
>
> }
> }
>
>
> [.....code needed to dissect the message's
> details....]
>
> if (((tvb->length) - offset) > 0)
> {
> tvbuff_t* new_new_tvb;
> new_new_tvb = tvb_new_subset(tvb , offset, -1, -1);
> dissect_phones_vklone_server(new_new_tvb, pinfo,
> phones_vklone_server_tree);
> return 1;
> }
>
> _______________________________________________________
>
>
> My idea was to dissect the packet until the end of the tvb is
> reached and if the offset remain less then tvb->length I
> call recursively the dissector on the remainig tvb's subset.
> At the top I recognize if there is a complete message's header
> or not and if yes I check if there is an entire message and ask
> for other bytes if needed.
>
> I'm still having problem with some packets.
> Is right my approach? Did you notice some big mistake or
> have some suggestion for me?
>
>
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFI+hfUEZ9DhGwDugRA+F2AJ9kUpsof35C3/id45LrUgxgO6s5wgCeIHrC
gbz/CwSqTztxpl4FdmObBYk=
=Y3Nr
-----END PGP SIGNATURE-----
