Wireshark · Ethereal-dev: Re: SV: [Ethereal-dev] Should "dissect_tpkt_encap()" check only its "desegment" argument, rather th

["Guy Harris" <gharris@xxxxxxxxx>]

Anders Broman wrote:

> That should probably make it easier to understand what needs to be done in
> order to get the packets reassembled.

I.e., it'd mean there'd be only two flags controlling whether to do
reassembly of Q.931 messages split across TCP segments, not three.  I
suspect that the fact that "dissect_tpkt_encap()" checks "tpkt_desegment"
is just a bug, perhaps from the code being cut and pasted without changing
all references to "tpkt_desegment" in it (I might well have been the
person who did that cut-and-paste).

> But as this question has been asked a number of times perhaps the default
> should be to do reassembly. Which has been discussed but I don't remember
> the arguments for and against.

My inclination is to have the default for all XXX-over-TCP dissectors be
"do reassembly", and the default for TCP be "don't do reassembly", so you
can turn off reassembly in all dissectors just by changing the TCP flag;
this is by analogy to other protocols, where fragmentation and reassembly
is done by the lower-level protocol, and where the lower-level protocol
has the one and only flag to control reassembly.  (The flags for
individual dissectors can be used in, for example, the case where there's
a reassembly bug in a particular dissector.)