Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] complex problem

From: Richard van der Hoff <richard@xxxxxxxx>
Date: Tue, 18 Oct 2011 11:43:14 +0100
Hi Marcel,

On 18/10/11 09:21, Marcel Haas wrote:
Jeff was saying to put my code before if(tree) if i get i right.. but
other dissectors use reassembling after if(tree) too.
Maybe i can conrtol it by "pinfo->fd->flags.visited" ??


It's correct that fragment_add_seq_check (or any reassembly logic) should be called whether or not tree is NULL. I don't see the example you gave of this not happening (in packet-atalk.c).

I still suggest that trying to write your own reassembly code is ultimately going to be more difficult than making what's there work. Did you ever try using a debugger as I suggested?

In this case I guess the problem is that your reassembly code isn't storing the reassembled tvb from its first pass and passing it back to your dissector on subsequent passes.

fragment_add_seq_check does use pinfo->fd->flags.visited to control this logic, as you suggest. But really - just make the reassemble.c code work.

Regards

Richard