Wireshark-dev: Re: [Wireshark-dev] reasebling packets - dissector question
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 22 Feb 2009 14:22:12 -0800

On Feb 22, 2009, at 2:14 PM, יוני תובל wrote:


what length exactly shoild  i return in the "get_len" function .
Do i need to return the expecte length of the PDU ?
Yes. That lets tcp_dissect_pdus() know how much data needs to be assembled.
and if so , what is the definition of the PDU (application layer data + header , or only data )
The PDU (obviously) doesn't include TCP or IP or link-layer headers (given that PDUs for protocols running over TCP can be split across TCP segments), but it does include all the fields for the protocol running on top of TCP - including any header that gives the length of the PDU (for protocols, such as DNS, that run over TCP and packet- oriented transport layers such as UDP).