Wireshark · Wireshark-dev: Re: [Wireshark-dev] Dissecting TCP PDUs

[Christopher Maynard <Chris.Maynard@xxxxxxxxx>]

Alexander Koeppe <format_c@...> writes:

> I have seen captures where e.g. several NetBIOS PDUs has been dissected
> as an individual branch of the protocol tree. Those PDUs aren't
> displayed under the TCP tree as mentioned above.

> Another protocol e.g. FIX (which is quite new), is being dissected as an
> individual branch of the protocol tree AND under the TCP tree as well.
> 
You are likely looking at a reassembled FIX packet since FIX relies on
tcp_dissect_pdus(), whereas NetBIOS does not.  The part under TCP is just the
unreassembled segment data of just one segment, but the part in its own
individual branch is all the reassembled segments that comprise the FIX packet.

There might also be a difference because FIX registers as a TCP heuristic
dissector whereas NetBIOS does not.  You might post a small capture file of each
that depicts what you describe.