Ethereal-dev: [Ethereal-dev] urgent

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "manu romu" <eucalipto_75@xxxxxxxxxxx>
Date: Wed, 19 Apr 2006 07:57:04 +0000
Hello,
I m on my way to finish my plugin but i've come across an unexpected problem. Some of packets are carried on TCP and often happen to be split over more TCP fragments. There was a length field in my header so I used tcp_dissect_pdus () to do reassembling. Yesterday I noticed that the total size of frags is almost always bigger than the length declared in my proto header! That's why I get an uncorrect reassembling.
I've read there's another way of carrying out reassembling, that is, modyfing pinfo struct, but i don't know how to handle it properly. I'd like to reassemble *ALL* TCP frags following my_proto packet *UNTIL* another my_proto packet is sniffed. 

How can I do it?

Thank you