Wireshark-dev: Re: [Wireshark-dev] fragment_add_..(), pinfo->src/dst, IP vs. TCP Session
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 11 Jul 2010 13:13:17 -0700
On Jul 11, 2010, at 12:56 PM, David Aggeler wrote:

> Thank for the hint. I've implemented this and am now merging this index 
> with the DICOM specific channel number.

So does that mean that DICOM multiplexes multiple sessions over TCP?

At some point, the conversation mechanism should probably be generalized, so that arbitrary protocols can define conversations, with TCP/UDP address-and-port-based conversations are just a particular subclass of the general class of conversations.

> There's a set of functions for dcerpc in reassemble,

That seems a bit wrong; the reassembly code should provide generic mechanisms into which, say, DCERPC-specific code can be plugged.

I'll look at that.

> so a specific set 
> for session aware protocols (like tcp) would not be that wrong.

What do you mean by "session-aware" in this context?