Wireshark · Ethereal-dev: Re: [Ethereal-dev] reassemble packets to identify a higher level protocol

[Ariel Burbaickij <ariel.burbaickij@xxxxxxxxx>]

Hi Jaap,
could you explain to me the reasons
behind the approach of having the 
options "Reassemble the H.225 or
H.245 over TCP" and option "Desegment
all TPKT packages spanning multiple
TCP segment"  for TPKT. I thought
till now (before looking at TPKT 
options) that what the reasembling
option of h.225 and h.245 is exactly this-
they reassemble h.225/h.245 as payload
of TPKT. Now I see that TPKT also provides
desegment option. What is it for?  Will it suffice
to switch TPKT desegment option on without
switching h.225 and h.245? How do these
two options work togehter?

With Best Regards
Ariel Burbaickij




On Thu, 23 Sep 2004 12:47:11 +0200 (CEST), Jaap Keuter
<jaap.keuter@xxxxxxxxx> wrote:
> 
> 
> On Thu, 23 Sep 2004 bujecas@xxxxxx wrote:
> 
> > It's possible to build a dissector or plugin that reassembles packets to
> > a higher protocol stream?
> 
> Ehhm, check out reassemble.c. So, yes it's possible
> 
> > For example, I need to identify a Siebel login
> > transaction, it lies on TCP packets, what I want to do is to reassemble
> > these packets to identify that it's a Siebel login. If it's possible can
> > you give some simple example?
> 
> See dissectors which offer the option in the preferences, like X.25, TPKT,
> TNS...... Maybe someone can point to a simple example.
> 
> > thanks.
> hava fun,
> Jaap
> 
> 
> 
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>