ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Get fragments from reassembly table

From: Anton Glukhov <anton.a.glukhov@xxxxxxxxx>
Date: Thu, 22 Mar 2018 16:07:05 +0100
I have dissector which works with fragments and reassembling by using fragment_add_check() and process_reassembled_data() functions. Now I got one problem. Each new fragment must be validated thought CRC32 calculation, but not for itself but for all previous fragments together. Here is an example: imagine that we received 3 fragments and now they are already in fragment_table. Next 4th fragment is coming and we need to verify it. In order to verify it we have to take all previous fragments(all 3 previous) out, concatenate them, calculate crc32 for all _four_ fragments together and put 4th fragment into fragment_table by using function fragment_add_check(). So, it looks like we do "temporary" reassemble for each new packet with all previous packet. Could you help me with ideas how to design it better?

My thoughts so far: I can reassemble them manually by allocate new buffer, getting fragment_head and going through linked list. But I don't think this is the best choice here.

Best regards,
Anton