Wireshark · Ethereal-dev: Re: [Ethereal-dev] TCP stream over multiple packets dissector

[alok <alokdube@xxxxxxxxxx>]

I know it is a stupid question, ethereal is a per packet/segment 
dissector but has anyone ben able to get around such a case (even if I 
can *flag* the specific conversation that it is a continuation so that 
the next packet dissection of the conversation knows it, it would be cool).


alok wrote:

> >     3) write a routine that, given a tvbuff that contains all of a 
> > single packet in your protocol and no extra data, will dissect that 
> > packet;
> >
> > and then have the TCP dissector for your protocol call 
> > tcp_dissect_pdus(), handing it the length value, the "get packet 
> > length" routine, and the "dissect one PDU" routine.  That routine 
> > will not only handle reassembly for you (as you ask for above), it'll 
> > also handle the case of multiple PDUs in your protocol within a 
> > *single* TCP segment.
>
>
>
> it is not a single TCP segment.....it is more like "packet 
> 1--ack_sent--packet 2".
> the information is split across packet 1 and 2.
> would this help here?
>
> -thanks
>
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev