Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 23471: /trunk/epan/dissectors/ /trun
From: Michael Tuexen <[email protected]>
Date: Sat, 17 Nov 2007 10:12:29 +0100
Hi Jeff,

see my comments in-line.

Best regards

On Nov 16, 2007, at 11:04 PM, [email protected] wrote:


User: morriss
Date: 2007/11/16 10:04 PM

When reassembly is off, catch ReportedBoundsError when calling a subdissector on the first fragment of a fragmented message. This allows us to continue dissecting chunks even if one of the first chunks in the frame was fragmented. (It's useful to keep doing this partial dissection just so we have some idea
what's in that chunk.)

(One could rightfully argue that you should only see a fragmented chunk bundled with another chunk when retransmitting but, well, I'm staring at traces of an implementation--to remain nameless to protect the guilty--which is sometimes fragmenting and then bundling the fragments into one packet.)
That is completely valid... Implementations are free to fragment user
data and bundle the fragments in one packet. There are even conditions where
this is required behaviour.

Directory: /trunk/epan/dissectors/
 Changes    Path              Action
 +1 -1      packet-frame.c    Modified
 +32 -5     packet-sctp.c     Modified

Wireshark-commits mailing list
[email protected]