ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] call_dissector(ip dissector handle) modify pinfo data

From: wsgd <wsgd@xxxxxxx>
Date: Wed, 29 Mar 2017 21:45:49 +0200

Hello all,


I have a protocol/dissector called vrf.
vrf         = ip/tcp/vrf/vrf payload
vrf payload = ip/tcp...

To manage vrf payload, I do :
  call_dissector(<ip dissector handle>, next_tvb, pinfo, tree);

Globaly, it is working.


BUT, not with the following scheme (4 packet contains 3 vrf message/pdu) :  
|-- packet1 --||-- packet2 --||--- packet3 ---||----- packet4 -----|
|------- vrf 1 --------||----- vrf 2 -------------||----- vrf 3 ---|

In this case, my dissector is NOT called for packet 3.
--> NOT ok


At the end of call_dissector into vrf 1, some fields of pinfo have been modified, at least :
- net_src
- net_dst
- src
- dst
- srcport                                      not matching the ones used for dissector_add_uint
- destport                                    not matching the ones used for dissector_add_uint
Start reading vrf 2 and stop (because packet2 has no enough data) with :
    pinfo->desegment_offset = 0;             /* Start at beginning next time */
    pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
Then, my dissector is NOT called for packet3 (it is called for packet4).
--> NOT ok

I suppose that the pinfo modifications are the reasons for which my dissector is not called for packet3 ?
When I cancel these modifications before continue, it works.


NB: it works if I use
  call_dissector(<data dissector handle>, next_tvb, pinfo, tree);


What is wrong ?
What is the normal way to manage this ?

 
Thanks,
Olivier