Wireshark · Ethereal-dev: Re: [Ethereal-dev] TCP stream over multiple packets dissector

[alok <alokdube@xxxxxxxxxx>]

Thansk Guy,

> Use tcp_dissect_pdus().
>
> You need to
>
>     1) come up with a length value large enough to include the 
> information version and length (or enough information to compute the 
> length) and small enough not to be larger than any packet;
>
>     2) write a routine that, given a tvbuff containing at least that 
> number of bytes, reads data from the packet with the tvb_get_ routines 
> and returns the total length of the packet (*including* the header);

* The first three arguments are the arguments passed to the dissector
* that calls this routine.
* "proto_desegment" is the dissector's flag controlling whether it should
* desegment PDUs that cross TCP segment boundaries.
 * "fixed_len" is the length of the fixed-length part of the PDU.
 * "get_pdu_len()" is a routine called to get the length of the PDU from
* the fixed-length part of the PDU; it's passed "tvb" and "offset".
 * "dissect_pdu()" is the routine to dissect a PDU.

This is the doc in the packet-tcp.h
now when I call the 1st routine as mentioned in 2, and i get the length 
and go on to call the dissect_pdu, will it take care that it should 
strip the data which corresponds to the get_pdu_len() part? in other 
words i will have to push the tvbuff forward by the amount till the 
length header?
-thanks