Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Packet reasembling

From: Vasyl Semchyshyn <Vasyl.Semchyshyn@xxxxxxxxxxx>
Date: Thu, 18 Dec 2008 10:01:51 +0200
HI all.
I know Wireshark can reassemble packets, and I have found several reassembling strategies, but it seams that none of them is suitable for me.

In my dissect function I'm receiving a buffer that consist of 32 bytes - this is one frame. Each byte of this frame is called timeslot, and enumerated from 0 to 31, e.g timeslot0, timeslot1, ....
Each timeslot can be divided into several sub-channels, for example bits 0 -1 from timeslot0 will be sub-channel1, bits 2-3 will be sub-channel2, and so on, it's like applying bit mask on timeslot(0xC  for sub-channel1, 0x30 for sub-channel2, ...).
To collect data of some sub-channel, we must take certain amount of bits at certain offset from the beginning of the frame, add them to buffer and continue doing this for each frame we have captured.
Fragment disassembling is not applicable here because concatenation of two frames will not be helpful.
Segment fragmentation is also not applicable because here work must be done with bits.

So can someone make some suggestions how to implement reassembling for this protocol?

"DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."