Wireshark · Wireshark-dev: Re: [Wireshark-dev] Multiple Packets in One TCP Segment

[wsgd <wsgd@xxxxxxx>]

Look at <wireshark sources>/doc/README.developer.
2.7 Reassembly/desegmentation for protocols running atop TCP.
2.7.2 Modifying the pinfo struct.


Olivier


Guy Harris a écrit :
> On Aug 17, 2009, at 11:22 AM, Aurélien Decagny wrote:
>
>   
> > When you use tcp_dissect_pdus, an argument is the length of the data  
> > to be decoded.
> >     
>
> Unfortunately, in her case, the length can't be determined except by  
> scanning the packet for a terminating character:
>
>   
> > On Aug 14, 2009, at 1:56 PM, Susan Ditmore wrote:
> >
> >     
> > > I am developing a packet dissector plugin for Wireshark. The packets
> > > I am dissecting do not specify their length in their header, but
> > > they are terminated by a special character (and can be a variable
> > > length). Additionally, multiple complete packets of the protocol may
> > > arrive in one tcp segment. I would like to know how to tell
> > > wireshark to divide up these packets. I understand there is a
> > > command called tcp_dissect_pdus(), but I believe it needs the length
> > > specified in the header. Is this correct?
> > >       
>
> so she can't use tcp_dissect_pdus().
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
>
>
>