Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Help_Wireshark] difference between fragmentation reassembly functions

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

[once more, please keep wireshark-bugs mailing list in copy, thanks]

Le 5 juil. 2017 06:41, "hhw hhw" <hhw.hhw7@xxxxxxxxx> a écrit :

hi pascal. thank you very very... much.

i shall change my dissector code. Now, my packets are like :

packet nb  sequence id    sequence number  message type  

1          16             0                0 Begin              

2          16             1                1 Continue               

3          16             2                2 End (more_frag=FALSE)

----------------------------------------------------------------------             

4          5              11               0 Begin               

5          5              12               1 Continue         

6          5              13               2 End  (more_frag=FALSE) 

-----------------------------------------------------------------------   

7          16             20               0 Begin              

8          16             21               1 Continue               

9          16             22               2 End (more_frag=FALSE)      

i use messagetype instead of morefrag. When messagetype=2 it means more_frag=FALSE and  this should complete reassembly.but i have problem, and packets 4,5,6 and packets 7,8,9  aren't reassembled.

my fragment may start at any sequence number (zero or non zero) . if an END message has been received a sequence id can assaign to another groups of packets( like id =16) .can you HELP me?

As I already explained in my previous message, the reassembly API expects the frag_number parameter to start from 0 for the first fragment of a given message and increase by 1 for each new fragment of the same message. If you apply this rule it will just work.

I don't know why you stopped using morefrag (which was perfectly fine) but if your messages always have up to 3 fragments you could use the message type as frag_number. If you can have several Continue packets for the same message, then you need to find another way to provide the frag_number parameter.

Best regards,

Pascal.