Wireshark · Ethereal-dev: [ethereal-dev] Messages exceeding 1500 octets resulting in Malformed frames. Are there functions to

[Dick Gooris <gooris@xxxxxxxxxx>]

*,

I am working on an analyzer section and made some major progress
- thanks to the README files and lot of examples :-)

Almost the first message I received was about 3036 octets long. This
means that the message I get is Malformed. I received the first 1500
octets which I believe is the standard ethernet boundary. The remaining
1536 octets are coming in two extra separate messages. The last two
message are not recognizable in the way I did with the first.

Therefore I need to work with sequence numbers and so, which require
some
new procedures or more coding in the area of the ethereal body, rather 
than programming on packet-sapphire.c/h files.

I guess I am not the first one who cannot (fully) decode a message
longer 
than 1500 octets. Are there any functions/procedures available or
examples
from existing packet-*.c files. ( I had difficuties to find these, or
overlooked ? )

There is no necessity to solve this in realtime. There should be an easy 
way to access the tvbuff of the next associated message, or to
concatenate
then beforehand, because the TCP/IP header indicates limitted data in
the
data section.

Hope you can help.

Many thanks in advance,

	- Dick Gooris          The Netherlands