Wireshark-dev: Re: [Wireshark-dev] Extending time before 2nd analysis pass
From: Guy Harris <[email protected]>
Date: Sat, 27 Apr 2019 21:31:57 -0700
On Apr 26, 2019, at 3:02 AM, Darien Spencer <[email protected]> wrote:

> I wrote a custom C dissector involving my own re-assembly logic.
> The problem I'm dealing with is:
> When capturing from high-capacity interfaces sometimes the segments to re-assemble arrive out of order

Do they arrive out of order at the protocol implementation as well?

If so, presumably the reassembly process in the protocol implementation knows when it's ready to provide reassembled data to its client; the reassembly code for the Wireshark dissector should do the same thing.