Hi!
I am new to Wireshark dissector development, and
encountered the following problem:
I am sending packtes, and the packets
are fragmented.
At first, I wasn't aware of the API's internal packet
re-assembly capabilities, so I tried to use a global buffer to accumulate the
packets' payloads. At the last packet, I dissected the buffer (now containing an
Ethernet packet) and added the result to the tree.
I did this just to
find out the Wireshark not only calls the dissector when first encountering a
packet, but also when I click it later... I didn't know that...
This is a
problem since using an accumulating buffer relies on the packets being dissected
in order. However, if I now click the in an un-ordered manner, the buffer
accumulates stuff wrongly. Moreover, If I don't click ALL packets involved in a
transaction, I only get part of the data.
So, I discovered the
fragment_add_seq()
function
and all that around it, but I still have the same problem:
My packets have
*No seq number or frag number* !!
Hence, I cannot use such numbers as
hash-table keys. I can only rely on transactions and fragments coming in
ordered, but that's it.
Now, I want the fragments being added to the hash
only when Wireshark first encounters a packet, but not again when I click it
later. Using a simple global counter to produce keys will cause the same problem
as before: When I later come back to observe packets a click them, they will be
re-dissected, and now that the counter has a different value than before (it has
advanced...), there will be no connection between a packet and the key produced
for it in the first encounter.
I can think of all kinds of nasty tricks
to solve this, but somehow I am sure there is an Wireshark provides an elegant
way to achieve this.
Thanks!
--
Use the source,
Luke!
