Wireshark · Wireshark-dev: Re: [Wireshark-dev] fragment_add_..(), pinfo->src/dst, IP vs. TCP Session

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 11, 2010, at 2:16 PM, David Aggeler wrote:

>>> That's what the fragment_add_seq routines are for ..
> Only the 'port numbers' are ignored,

To what port numbers are you referring?  The fragment_add_seq routines are used to reassemble data from protocols that have no port numbers.

> i.e. they are not as hierarchical 
> as they should be :-). E.g. it feels like IP-DICOM, The TCP level is 
> somewhat ignored.

The fragment_add_seq know nothing of IP or TCP, which is as it should be.

If the issue is reassembling packets from separate TCP connections separately, one solution is to have separate fragment and reassembled tables per TCP connection (or per whatever type of connection is involved).