Wireshark · Ethereal-dev: [Ethereal-dev] Reassembly of TCP + reassembly of RPCoverTCP and NBSSoverTCP

["Pia Sahlberg" <piabar@xxxxxxxxxxx>]

Hi,

I hate fragmented packets.

Attached is a patch for ethereal, please test it and check it in.
I have tested it for several mediumsized captures and it seems to work quite 
well.

The patch contains the following features:
* (major part) changes to packet-tcp.c to allow it to desegment
segments into larger blocks if a dissector called from packet-tcp.c
requests it. This option must be enabled for any of the other options to 
work.
Desegmentation is different from reassembly of IP packets.
* (very small) changes to packet-rpc.c to allow RPCoverTCP desegmentation.
* (very small) changes to packet-nbns.c to allow NBSSoverTCP desegmentation.

The default setting for these three options is OFF, so by default ethereal 
will behave as it always has.

(for desegmentation of NBSS to be really useful we musrt wait for
packet-smb.c to be tvbuffified so that SMBtransact can get reassembled.)

Please look at the changes to packet-rpc.c : It is extremely easy/trivial to 
apply TCPdesegmentation to other protocol dissectors.


The file also contain a text file explaining the three new options.

Have fun, play with it, enjoy and please check in.


best regards
  ronnie sahlberg


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

Attachment: tcp.tgz
Description: application/gzip-compressed