ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 01 May 2013 16:21:48 -0400
On 05/01/13 11:01, Ambarisha B wrote:
On Thu, Apr 25, 2013 at 7:34 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx
<mailto:jeff.morriss.ws@xxxxxxxxx>> wrote:

        But the dissectors create the tvb from the reassembled data. So,
        if we
        define a new type of tvbuff which has to be used, wouldn't that
        effect
        the dissectors?


    It shouldn't: dissectors should be using the TVB-accessor functions
    so they shouldn't care what kind of TVB they are handed.


Please bear with me, I may be missing something obvious here.

Reassembly code returns a fragment_data to a dissector(say, tcp
dissector specifically). The dissector uses fragment_data->data in a
call to tvb_new_child_real_data(). fragment_data->data points to a
buffer containing the complete reassembled pdu. What will this data
member contain incase of a reassembly implementation which uses
filebacked tvbuffs?

Well without looking into the code (and keep in mind I'm relatively ignorant of the reassembly stuff in general), I'd think: change the reassembly API so it returns a TVB (now file-backed). (I imagine that most dissectors just build a TVB out of the returned data anyway.)