Wireshark-dev: Re: [Wireshark-dev] Extending time before 2nd analysis pass
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 27 Apr 2019 21:31:57 -0700
On Apr 26, 2019, at 3:02 AM, Darien Spencer <cusneud@xxxxxxxx> wrote:

> I wrote a custom C dissector involving my own re-assembly logic.
> The problem I'm dealing with is:
> When capturing from high-capacity interfaces sometimes the segments to re-assemble arrive out of order

Do they arrive out of order at the protocol implementation as well?

If so, presumably the reassembly process in the protocol implementation knows when it's ready to provide reassembled data to its client; the reassembly code for the Wireshark dissector should do the same thing.