ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Reassembly of messages

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Sun, 28 Nov 2010 10:31:10 -0700
On Sun, Nov 28, 2010 at 05:05:48PM +0100, Andreas wrote:

> packet #116, offset:0 len:42403, COL_INFO:1, visited:1 tree:1 pdu 
> length: 42403 -> MessageF
> 
> packet #116, len:197, offset:1283 len:197, COL_INFO:0, visited:1 
> tree:1
> pdu length: 68 -> MessageG
> pdu length: 36 -> MessageH
> pdu length: 36 -> MessageH
> pdu length: 36 -> MessageH
> pdu length: 36 -> MessageH

> Two problems arise:
> - The COL_INFO is false. No text can be added to the INFO column.
> - The second call for packet #116 should add the information about 
> message G,H,H,H and H. It does not get an indication, that it should 
> add some text instead of replacing it.
> 
> Do you have any suggestion, how I can manage to display "Message 
> F,G,H,H,H,H" in the info column for packet #116?

Thanks for all of the details.  The problem seems to be coming from the 
fact that there are more than one PDU in packet #116.  The 
tcp_dissect_pdus code in packet-tcp.c says that it blocks changes to all 
of that packet's columns (because it can't just block the protocol 
column - the only one it needs to change) to prevent the TCP dissector 
from changing the protocol from the proper one back to "TCP" This is why 
you're getting the indication from check_col that COL_INFO isn't 
writable.  Try adding "col_set_writable(pinfo->cinfo, TRUE);" before you 
write to the INFO column to see if it lets you write information for 
PDUs G through H (you'll need to use col_append_str() so it doesn't 
overwrite the information for PDU F.)