Ethereal-dev: Re: [ethereal-dev] Multiple PDUs in one TCP segment ...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Mon, 7 Aug 2000 20:49:43 -0700
On Tue, Aug 08, 2000 at 12:30:03PM +0900, Richard Sharpe wrote:
> This one has multiple messages (PDUs) in one TCP segment ...

Actually, we already have several dissectors for protocols with multiple
PDUs in one TCP segment:

	NetBIOS-over-TCP session service

	ONC RPC over TCP

and so on....

> If I dissect them correctly, which sould be:
> 
>   [+] TCP .......
>   [+] NEW DISSECTOR
>    +--[+] PDU 1
>    +--[+] PDU 2
> 
> Filtering might be a bit of a problem, in that each PDU is likely to have
> the same field types, like
> 
>    new-proto.cmd
> 
> or
> 
>    new-proto.seq
> 
> and so on ... 

Well, filtering is intended to be used to select those frames with given
properties; if you have two PDUs in a frame, with different
"new-proto.cmd" values, you'd probably want a filter checking
"new-proto.cmd" to match that frame if *either* of those values made the
filter expression true.

There are already frames with more than one instance of a given field;
this is the same sort of thing.