Ethereal-dev: [ethereal-dev] TCP stream, UDP fragmentation

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Uwe Girlich <Uwe.Girlich@xxxxxxxxxxx>
Date: Mon, 22 Nov 1999 07:59:39 +0100
I'd like to add some thoughts to the TCP stream discussion.

An important feature would be to provide somehow the dissectors with the 
concatenated data from multiple packets. At least the RPC portmapper dump reply
(user program rpcinfo uses this) goes over many TCP data packets and it would
be nice to parse the whole stream and not only the first packet, where the
header is included.

An incarnation of the same problem are fragmented UDP packets. Modern NFS
servers support 32K read/write size, so we get (over Ethernet) 23 UDP fragments
(1472 UDP bytes) and only the first has the UDP/RPC/NFS header. All the rest
are merely IP fragments. It would be nice to bring them together.