Ethereal-dev: Re: [ethereal-dev] TCP and higher level dissectors (sub-dissectors)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Sharpe <sharpe@xxxxxxxxxx>
Date: Tue, 03 Oct 2000 05:21:39 +0900
At 11:44 AM 10/2/00 -0700, Guy Harris wrote:

Many comments, now deleted, about what Jeff Foster had to say ...

One big problem we have in anycase, is that, even if we pass higher level
dissectors the data in order with duplicates eliminated, we still cannot
handle to problems of missing segments.

Segments may be quite legitimately missing from the packet stream because
of multiple paths between the to communicating parties.  

These missing segments can take the form of data in one direction taking a
different path to data in the other direction, resulting in you only seeing
half the transmission.

They could also take the form of data in each direction taking different
paths, resulting in you seeing a very patchy transmission ...

Any higher level dissector has to be able to handle missing packets, or
risk blowing up when trying to handle the data.  This means that it needs
some sort of fallback and handle the higher layer as undissected data ...

Regards
-------
Richard Sharpe, sharpe@xxxxxxxxxx
Samba (Team member, www.samba.org), Ethereal (Team member, www.zing.org)
Contributing author, SAMS Teach Yourself Samba in 24 Hours
Author, Special Edition, Using Samba