Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to access value of hdr.frag_len from subdissector?

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Jun 17, 2002 at 07:33:11AM +1000, Ronnie Sahlberg wrote:
> The DCE RPC dissector already supports fragment reassembly for connection
> oriented DCERPC.

Unfortunately, he indicated in mail to me that he's running over UDP, so
it's connectionless DCE RPC.

I have a change to make the connectionless DCE RPC dissector at least
not hand the middle and last fragments of fragmented PDUs to the
subdisssectors; I'll check it in sometime today.  (I don't guarantee
that it won't break anything, as I don't know whether I have any
captures with connectionless DCE RPC.  If somebody has captures with
connectionless DCE RPC - especially if there are fragmented PDUs - that
they could send me so I can test the change with those PDUs, that'd be
helpful.)

> Just do some cut-n-paste in packet-dcerpc.c if you need reassembly for
> connection-less DCERPC as well.

Unfortunately, it's cut-n-paste-n-edit, as connectionless DCE RPC
fragments may arrive out of order, so there's an additional complication
for connectionless reassembly; the connectionless header has a "this is
a fragment" flag, a "this is the last fragment" flag, and a fragment
ordinal number.  (It's probably not *much* complication, as the
"fragment_add_seq_check()" stuff could be used, but it's not just
cut-n-paste.)

I'll look at doing the reassembly, but without fragmented connectionless
traffic, I'd have to write the code and hope it works, rather than test
it.  (I'll see if I have any captures with such traffic, but I suspect I
don't.)