Wireshark · Ethereal-dev: Re: [Ethereal-dev] Another Stupid Question

[David Frascone <dave@xxxxxxxxxxxx>]

> 
> 		nifty_make_new_tvb_call(tvb, difference in length);
> 
> is, as presented, unimplementable, as "nifty_make_new_tvb_call()" is not
> being passed any information about where to get the additional data to
> make up the difference in length.
> 

True.  But I wasn't thinking straight.  My senario is multiple *small* packets
being grouped together by TCP, not huge streams being broken apart.  So, the
pseudo code would have worked, but only for multiple packets in a single 
TCP frame.

The problem still exists when a packet gets split up.  When this occurs, there
is no way for the dissector to find the start of a fresh packet.

Currently, for testing, we have been flooding our server with small packetss.
I think it's time to switch the test program to something like a ping, that
has a bit of a delay between packets.  That should solve my current problem, and
keep TCP from fragmenting and grouping my packets.

Thanks for everyone's input . . . I just wish there was an easy answer.


Dave