ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] TCP Reassembly issues

From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Tue, 10 Jul 2007 10:34:03 +0000
On 7/10/07, Graham Bloice <graham.bloice@xxxxxxxxxxxxx> wrote:

DNP application message fragments are carried in a transport layer which has
a
single byte header containing a 6 bit sequence number (tr_seq, 0-63) and two
flags, first (tr_fir) and final (tr_fin).

A single fragment message will have both flags set.

The sequence number does not necessarily reset to 0 at the start of a
sequence
of fragments, it just runs sequentially from the fragment where the first
bit
is set.

Because the protocol sequence number is repeated between hosts, I needed to
invent a unique one to link related application message fragments together,
hence the static seq_number.  The aim of this is to allow many conversations
between hosts that are individually identifiable, but reuse the protocol
sequence number.  If I understand correctly, you are saying that I should
only
increment this and add fragments when first finding a fragment, i.e. the
flag.visited is false.

Maybe packet-nbd.c is useful.
NBD clients often reuse the transaction ID once a previous transaction
has completed making tracking more difficult.

NBD has a structure attached to each conversation,   this structure
contains two hashtables,
one for unacked packets which is populated on initial scan
and a second hashtable which is used later.