ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] no size information in fixed header-length for tcp_dissect_pdus(

From: Robert Naumann <robert.naumann@xxxxxxxxxxxxxxxxxxxx>
Date: Thu, 07 Jun 2007 16:13:09 +0200
hello,

in the rfb-protocol i've to dissect i got some zlib-compressed FramebufferUpdates. The PDU-header doenst contain any information about the compressed data-bytes, so i decided to sniff in the compressed data, as there are the lenght information of one compressed part is stored. So i can move on the datastream to the next size information until the end of the PDU. My GET_PDU_LEN()- function reports the correct size of the hole PDU. Now to the problems i got. The fixed-length-parameter is set to something, because i dont have any information about the length of the PDU in my PDU-header. As far as i understood i should set the fixed-lenght-parameter to the databytes which are containing the size information of my last compressed part. the number of compressed parts in the PDU is variable, so the best way is to calculate how much compressed parts my PDU contains. Do i have a chance to calculate the length before i'm using the function tcp_dissect_pdus()? If so, plz can anyone tell me how?

For testing purposes i tried with a fixed lenght for my first zlib-compressed FramebufferUpdate-PDU. My GET_PDU_LEN()- function still reports the correct size of the hole PDU, but wireshark doesn't seem to use this size. Instead the size of my fixed length parameter is used an i get a wrong dissection.

kindest regard

Robert