Hi list
attached is a patch for NDMP.
it fixes a number of small bugs in the initial dissector in cvs
this patch should apply cleanly to cvs
it works reasonably well (really well actually) but there are a few things
still missing
* some heuristics to really cheack if the tcp segment really starts with a
new NDMP packet or not
and not just blindly assuming it can start ndmp dissection
* it should reassemble also fragmented sequences of packets (sequences where
the MSB of the size
field is 0) Some captures I have gets mightily confused when there are huge
ndmp commands
which consists of multiple 3996byte large fragments.
Before I can add this to NDMP (as well as for ONC-RPC) I need to wait for
some really nice new features to
the reassemby.c that Ricardo works.
You might want to use defragmentation ALWAYS when using NDMP. Many packets I
have seen
come with one TCP segment only containing the 32bit size (and fragment)
field, and then another segment for
the actual ndmp header and command.
It is not very useful without activating reassembly.
(this will be fun. i am not aware of any of the other analyzers being
capable of reassembly. if it is really nessecary for an ndmp
dissector that the tcp layer must support segment reassembly, then i guess
they will have to wait even longer before any
of those two products will support ndmp)
have fun
ronnie sahlberg
Attachment:
ndmp_2.patch.gz
Description: GNU Zip compressed data
