Ethereal-dev: Re: [ethereal-dev] looking at TNS/Oracle stuff...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 22 Nov 1999 17:26:18 -0800 (PST)
> One thing - it looks like Sniffer Pro does some stuff with reassembling
> multiple frame requests and similar. I remember hearing some start of a
> discussion about this with RPC, so it might be worth thinking about for the
> oracle stuff as well.

Reassembly of IP fragments, or of fragments from any other protocol that
defines fragments at a low layer, should be doable at that low layer, so
it should work for any protocol above that layer.

Reassembling TCP segments is trickier, as TCP is a byte-stream protocol,
and record markers must be added by a higher-level protocol, e.g. the
ONC RPC RPC-over-TCP fragment markers, or the byte count in the
NetBIOS-over-TCP session service header, or the byte count put in for
DNS-over-TCP.  That'd require that each protocol that puts record
markers in have code to reassemble records parts of which are in more
than one TCP segment, as well as breaking part TCP segments that contain
more than one record.