Hi
One of my remaining items with GIOP
support is FRAGMENT reassembly (yep, fragmentation
at GIOP/IIOP level).
So, before I waste hours duplicatinhg existing code,
can someone tell me what API is available for users to do reassembly high
above the IP or TCP
layers.
Ethereal currently only supports IPfragment style reassembly.
That is, ethereal can easily be extended to reassemble anything which
is similar to how IP is fragmented.
This API is inside reassemble.c
The following characteristics must be met:
* It must be possible to determine if a packet is a fragment of a larger
packet by just looking at the packet-header itself.
(IP fragment field)
* It must be possible by looking at a single packet to determine if
this was the last fragment of the packet.
(IP MoreFragments flag)
* The fragments may arrive in any order.
* The fragment itself contains sufficient data to uniquely identifying
which packet it is a fragment of.
(There is not yet an API for TCPstyle defragmentation,
i.e. something which have the following characteristics:
* An isolated packet/fragment does not contains sufficient information
to determine if it is a fragment or if it is a normal packet.
(must look at sequence numbers in TCP, only sequence numbers in a
specific (unknown) interval contains a defragmented packet)
* Packets must arrive in-order for defragmentation to work.
(It is only possible to determine that a tcp-segment is part of
a larger packet by looking at the earlier segment in the stream)
* Packets do not contain sufficient infor to determine WHICH packet it
is a fragment/segment of. One must trace segment numbers packet by
packet to know this.
Ethereal may or may not gain this functionality in the near future.
)
Are there functions to a allow a virtual complete (unfragmented) tvbuff to
be created from a couple
of existing tvb's (or parts thereof), and how
persistent is this.
The (fully) defragmented packets will each stay permanenty in a contignous
memory buffer until a new capture is opened or ethereal is quit.
This can significantly elevate the memory requirements for running
ethereal why it might be good to control defragmentation using a
prefs option.
It is the responsibility of the dissector itself to convert the memory
buffer into a TVB each time the packet is looked at by ethereal.
The memory buffer holding the defragmrentated packet is persistent
but the TVB is not.
ie: By the time I have all the fragments, do they
all still exist inside tvb's or have they been freed ?
See the changes made to packet-ipv6.c between version 1.57 and 1.58
which is when fragment reassembly was added to ipv6.
It should be fairly easy to use that as an example.
best regards
ronnie s
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
