On Thu, 27 Jul 2000 00:40:07 Uwe Girlich wrote:
>
>
>
> things like TCP header fragmentation to fool a firewall) but Ethereal
> should
> be able to detect problems (at least I use it so), so I expect also lots of
> fragments, which don't fit together or one double sended fragment with the
> wrong offset or similar things. We need some kind of user interface so that
> the user can corrent the reassembling until he thinks it is good.
Why would the user need to get involved in the reassembly? I would imagine
that Ethereal would defrag the IP packets and end up with either one or zero
correctly defragmented packet, with possibly "left-over" packets that had
bad offsets or were re-transmitted.
>
> Where should the decoded data tree appear? In the window of the first
> packet?
> distributet over all fragments or would it be better to include a faked
> packet
> after all fragmens were collected, which contains a TVBUFF_COMPOSITE
> tvbuffer?
I was thinking about creating a new CList of packets, with the used fragments
removed, and a new "virtual" packet (the TVBUFF_COMPOSITE packet) that exists
in place of one of the IP fragments, either in place of the first IP fragment,
or
the last. (That could be user-configurable)
> The IP layer must be corrected in this newly created IP packet (the 'more
> fragments' bit in the IP flags must be zeroed) but everything else could be
> used from the fragment with the 0 fragment offset.
>
> Uwe
--gilbert
