ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Reassembling: pinfo and 2 functions

Date: Tue, 28 Apr 2009 14:56:00 +0000
Hello people,

I am trying to reassembly my messages and am having a lot of trouble understanding how it works. I dont quite understand the process that it goes through and when to call functions / set variables. From looking at other dissectors it looks like these are the things to change:

gboolean fragmented;
guint16 can_desegment;
int desegment_offset;
guint32 desegment_len;

a fragment_data object

fragment_add_check()
process_reassembled_data()

but i'm having trouble understanding what each of these really do or how to manipulate them to say that a certain part of the buffer if part of a message and how to add to it and then display it. 

Any help explaining these more would be great help. I've read reassemble.h and looked at teh source, but i'm not sure how to use them in actual code. I've also looked at packet-scsi.c and still dont understand how to implement these with my dissector. which im trying to reassemble a multi-part message which goes like this:

bnp header [3](3 bytes) + message and information elements
bnp header [4](3 bytes) + information elements
bnp header [4](3 bytes) + information elements
bnp header [5](3 bytes) + information elements

bnp header: byte 1 - type [types: 2 whole data, 3 multi part start, 4 middle, 5 end of multi part]
            byte 2,3 - number of bytes after bnp header. 

so i would like to take just the data sections for reassembly:
message and information elements + information elements + information elements + information elements

and then have that sent to be dissected as a whole packet.

Thank you in advance to whoever can help,

Greg