Wireshark-dev: Re: [Wireshark-dev] Handling TCP packets reordering
From: Jeff Morriss <[email protected]>
Date: Wed, 04 May 2011 17:43:21 -0400
Max Dmitrichenko wrote:
2011/5/5 Jeff Morriss <[email protected]>:

I would think desegment_tcp() should be able to handle this by not calling
your dissector for an out-of-order segment: it should be able to only call
your dissector once it has a completely reassembled (desegmented) PDU.
Did you mean using of tcp_dissect_pdus(....)? As for now I use
pinfo->desegement_len
and pinfo->desegment_offset stuff. But if it is that simple, I surely redo using
this function.
Actually I meant the pinfo->desegment_len stuff (I'm not really familiar 
with dissect_pdus()).
I did stumble across a (apparently unrelated) problem in that it will 
fail if you see a gap while the subdissector is returning 
DESEGMENT_ONE_MORE_SEGMENT (as HTTP does until it gets all the headers): 
in that case TCP has to assume that the current message is not part of 
the existing multisegment_pdu--which unfortunately breaks things.  Not 
sure what can be done about that...