fabio matturro wrote:
The lower-level protocol is UDP. The protocol I'm dissecting is called PVM.
There are packets in PVM which are correlated but are still different
packets, not fragments.
So there are no flags saying the packet is actually a fragment.
Again, there is an operation in PVM called SPAWN. Spawn generates 4
different packets (called EXEC, EXECACK and so on). What I'd like to do
is to show JUST ONE PACKET, label it as SPAWN
bacause in my opinion the user doesn't care about details (exec,
execack...) but just wants to check
whether its spawn operation has succeded : )
Can I do it?
*IF* there's something in the PVM protocol to allow a dissector for that
protocol to, in effect, treat those 4 packets as fragments of a bigger
"packet", and *IF*, once the PVM-layer content of those 4 packets are
concatenated, the dissector can pull the 4 parts apart so it knows which
part is EXEC, which part is EXECACK, etc. (because reassembly just
concatenates the fragment data together), *THEN* it should, I think, be
possible to do that.
Now, whether the user of Ethereal would care about the details or not is
another matter; Ethereal is a protocol analyzer, and, at the protocol
layer, they might well really be 4 separate operations, and the user of
Ethereal might be trying to see to see the details of the operation.
