Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Reassemble packets decoding - not proper

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 8 Dec 2009 12:21:18 -0800

On Dec 8, 2009, at 2:33 AM, Rach, Darshan wrote:

Two queries.
1. Is it possible to display the actual payload in place of "Fragment data"? (please see the mail chain below for reference)

What do you mean by "display the actual payload"?

2. If the packets are fragmented, the last fragment is not shown and instead, shows "Message Reassembled". How is it possible to display even the last fragment as "Fragment n" and then, next, display the reassembled packet.

Try something such as this:

				if(((block_number == 0) && (last_packet_flag == 0)) ||
				   (block_number > 0))
				{
					/*darshan*/
					pkt->fragmented = TRUE;

					/* Add this fragment to the protocol tree. */
proto_tree_add_text(oqtp_tree, tvb, packet_field_offset, -1, "Fragment data");

					frag_msg = fragment_add_seq_check(tvb, packet_field_offset, pkt,
													  msgid, /* ID for fragments belonging together */
													  msg_fragment_table, /* list of message fragments */
													  msg_reassembled_table, /* list of reassembled messages */
													  block_number, /* fragment sequence number */
													 tvb_length_remaining(tvb, packet_field_offset), /*
fragment length - to the end */
													  !last_packet_flag); /* More fragments? */

					new_tvb = process_reassembled_data(tvb, packet_field_offset, pkt,
													   "Reassembled OQTP Message",
													   frag_msg,
													   &msg_frag_items,
													   NULL,
													   oqtp_tree);

					/* Reassembled */
					if (frag_msg)
					{
						col_append_str(pkt->cinfo, COL_INFO,
									   "(Reassembled OQTP Response)");
					}
					else
					{
						/* Not last packet of reassembled short message */
						col_append_fstr(pkt->cinfo, COL_INFO,
										"(OQTP fragment %u)", block_number);
					}

					if (new_tvb) /* take it all */
					{
						next_tvb = new_tvb;
					}
					else
					{
						/* We cannot dissect anything yet, as we don't have a
reassembled packet */
						next_tvb = NULL;
					}
				}
				else
				{
					next_tvb = tvb_new_subset(tvb, packet_field_offset, -1, -1);
				}

				/*restoring fragmented state*/
				pkt->fragmented = save_fragmented;

				if (next_tvb != NULL)
				{
					/* Not a fragment, or fragments were reassembled */
					packet_field_offset = 0;

					/*Request Satisfied*/
					request_satisfied = tvb_get_guint8(tvb, packet_field_offset);
					proto_tree_add_uint(oqtp_tree, hf_request_satisfied, tvb,
packet_field_offset, 1, ((request_satisfied & 0x80) >> 7));

					/*Reserved_for_future_use*/
					reserved_for_future_use = ((tvb_get_guint8(tvb,
packet_field_offset)& 0x7E) >> 1);
					proto_tree_add_uint(oqtp_tree, hf_reserved_for_future_use, tvb,
packet_field_offset, 1, reserved_for_future_use );

					/*No Extended pd syntax*/
					no_extended_pd_syntax = (tvb_get_guint8(tvb, packet_field_offset)
& 0x1);
					proto_tree_add_uint(oqtp_tree, hf_no_extended_pd_syntax, tvb,
packet_field_offset, 1, no_extended_pd_syntax );
					packet_field_offset += 1;

					/*Number of classifications*/
					proto_tree_add_item(oqtp_tree, hf_num_classifications, tvb,
packet_field_offset, 1, FALSE);
					num_classifications = tvb_get_guint8(tvb, packet_field_offset);
					packet_field_offset += 1;

for(loop_index = 0 ; loop_index < num_classifications ; + +loop_index)
					{
						...
					}

						...
				}

				break;