Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Defragmenting non-tcp streams

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 7 Jan 2010 03:26:32 -0800
On Jan 7, 2010, at 1:48 AM, paul@xxxxxxxxxxxxxx wrote:

> TCP has a tcp_dissect_pdus() function that higher protocols can use
> to  eliminate their dependency on the TCP framing. Is there anything
> generic for other layers? I'm writing a USB dissector which is really
> a serial protocol being transported over USB.

That's

	http://www.nordicsemi.com/files/Product/data_sheet/User_guide_ANT.pdf

right?

If so, and if you're reassembling the packets in a burst transfer, this isn't a byte stream, so you can ignore the TCP dissector, and look instead at the IP dissector for an example.  It's not *quite* the same as IP, as

	1) you have sequence numbers rather than byte offsets, so you'd use fragment_add_seq_check() rather than fragment_add_check();

	2) the sequence number wraps around, so you'd have to keep some state and provide a "synthesized" sequence number that doesn't wrap around.