Herbert Falk wrote:
I have written a TCP dissctor and captured a trace. The first call to
the dissector passes one complete PDU and a partial of another. Any
ideas how to retrigger the dissector so that both PDUs are dissected?
Presumably by "TCP dissector" you mean a dissector for a protocol
running atop TCP.
If the protocol's PDUs has data at the beginning of it whose contents
can be used to determine the length of the PDU (either because it has a
length field or because, for example, it has a PDU type field and the
length of a PDU of a particular type is fixed), and the amount of data
you need is <= the minimum total size of a PDU, you can have your
dissector call "tcp_dissect_pdus()"; that routine takes as an argument:
the number of bytes of data needed to determine the length of the PDU;
a routine that gets passed a tvbuff and offset, which should assume the
data in question starts at the specified offset in the specified tvbuff
(and that all that data is present), and fetches the data and returns
the *total* length of the PDU (*including* the data at the beginning);
a routine to dissect the PDU, which takes the same arguments as a
regular dissector;
a flag indicating whether to do reassembly of PDUs that cross TCP
segment boundaries - you could make it a preference, which should
default to TRUE, or you could just pass TRUE;
and does all the reassembly and segment-splitting work for you.
