Wireshark · Ethereal-dev: Re: [ethereal-dev] Reassembling packets

[Guy Harris <guy@xxxxxxxxxx>]

> I wonder if ethereal has any generic support for protocols which spread
> their payload over multiple UDP packets ?

Nope.

It doesn't even have any support, at present, for protocols that spread
their payload over multiple IP fragments (today's show is brought to you
by the letters "N", "F", and "S"...).

At some point, we probably want to

	1) handle payload spread over multiple frames in a number of
	   places, including:

		payload spread over multiple IP fragments;

		payload spread over multiple TCP segments;

	2) generalize the notion of conversations to work at multiple
	   protocol layers, and to handle conversations other than just
	   "host XXX port YYY talking to host ZZZ port WWW" (for
	   example, a TFTP conversation starts as host XXX port YYY
	   talking to host ZZZ port 69, and then has host ZZZ port WWW
	   talking to host XXX port YYY, and continues between XXX/YYY
	   and ZZZ/WWW, and an NFS "conversation" could well include
	   *multiple* ports in that it would include not only NFS
	   traffic but also lock manager and perhaps mount daemon
	   traffic);

which would probably supply more infrastructure for the sort of stuff
you're doing.