Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Troubles With Reassembly

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 22 Apr 2009 14:55:45 -0700

On Apr 22, 2009, at 2:35 PM, gogrady@xxxxxxxxx wrote:

i'm not really sure what i'm supposed to be looking into for doing my
own assembly stuff. I was looking at reassemble.c as well as some
packet-foo.c files that did their own reassembly, but i found them quite confusing. Is there any part of the reassemble.c file you would recommend,
or an example file or anything you could point me at?

Which dissector I'd use as an example would depend on how the multi- message stuff works.

Is the idea that, if you have a sequence of, for example:

	BNP header+multimessage begin
	BNP header+multimessage middle 1
	BNP header+multimessage middle 2
	BNP header+multimessage end

you would strip off all the BNP headers, concatenate the four BNP data chunks in order (begin, middle 1, middle 2, and end, in that order), and then dissect the concatenated chunk as a single message?