ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Reassemble packets decoding - not proper

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 7 Dec 2009 00:01:34 -0800

On Dec 6, 2009, at 10:44 PM, Rach, Darshan wrote:

Kindly let me know what might have gone wrong.

Sorry, I forgot to indicate that, once you get to the point where you dissect the field with the "request satisfied" bit, you're dealing with a tvbuff that starts with that field, so you have to reset packet_field_offset to 0, *AND* you have to fetch fields using next_tvb, not tvb, so you're using that tvbuff:

				if (next_tvb == NULL)
				{
/* Just a fragment - put an item into the protocol tree for the fragment data */ proto_tree_add_text(oqtp_tree, tvb, packet_field_offset, -1, "Fragment data");
				}
				else
				{
					/* Not a fragment, or fragments were reassembled */
					packet_field_offset = 0;

					/*Request Satisfied*/
					request_satisfied = tvb_get_guint8(next_tvb, packet_field_offset);
proto_tree_add_uint(oqtp_tree, hf_request_satisfied, next_tvb, packet_field_offset, 1, ((request_satisfied & 0x80) >> 7));

					/*Reserved_for_future_use*/
reserved_for_future_use = ((tvb_get_guint8(next_tvb, packet_field_offset)& 0x7E) >> 1); proto_tree_add_uint(oqtp_tree, hf_reserved_for_future_use, next_tvb, packet_field_offset, 1, reserved_for_future_use );

					/*No Extended pd syntax*/
no_extended_pd_syntax = (tvb_get_guint8(next_tvb, packet_field_offset) & 0x1); proto_tree_add_uint(oqtp_tree, hf_no_extended_pd_syntax, next_tvb, packet_field_offset, 1, no_extended_pd_syntax );
					packet_field_offset += 1;

					/*Number of classifications*/
proto_tree_add_item(oqtp_tree, hf_num_classifications, next_tvb, packet_field_offset, 1, FALSE); num_classifications = tvb_get_guint8(next_tvb, packet_field_offset);
					packet_field_offset += 1;

						...