Wireshark · Wireshark-dev: Re: [Wireshark-dev] Troubles With Reassembly

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 22, 2009, at 2:35 PM, gogrady@xxxxxxxxx wrote:

> i'm not really sure what i'm supposed to be looking into for doing my
> own assembly stuff. I was looking at reassemble.c as well as some
> packet-foo.c files that did their own reassembly, but i found them  
> quite
> confusing. Is there any part of the reassemble.c file you would  
> recommend,
> or an example file or anything you could point me at?

Which dissector I'd use as an example would depend on how the multi- 
message stuff works.

Is the idea that, if you have a sequence of, for example:

	BNP header+multimessage begin
	BNP header+multimessage middle 1
	BNP header+multimessage middle 2
	BNP header+multimessage end

you would strip off all the BNP headers, concatenate the four BNP data  
chunks in order (begin, middle 1, middle 2, and end, in that order),  
and then dissect the concatenated chunk as a single message?