Ethereal-dev: Re: [Ethereal-dev] Fragments of PDU in TCP packets.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 25 Feb 2002 10:55:50 -0800
On Mon, Feb 25, 2002 at 02:07:02PM -0000, Garth Bushell wrote:
> iSCSI.

(As I expected, given where you work. :-))

> We are getting the PDU split accross TCP packets and so ehtereal gets
> a bit confused.

The fact that an iSCSI PDU is split between TCP packets shouldn't be
sufficient to cause Ethereal to become confused, if desegmentation is
enabled.

The iSCSI dissector *does* include desegmentation support.  If, in the
current version of Ethereal (0.9.1) you've enabled both general TCP
desegmentation ("Allow subdissector to desegment TCP streams" in the
preferences for TCP) and iSCSI-over-TCP desegmentation ("Desegment iSCSI
messages" in the preferences of iSCSI), it should correctly reassemble
iSCSI PDUs split across TCP segments, *if* all the relevant segments are
in the capture file.

If not, then there's either a bug in the TCP desegmentation code or in
the iSCSI dissector.

> Where is the Documentation for this? I have always used
> README.developer file. Where else would I look?

You'd have to look in the source code.  Not all features in the Ethereal
packet dissection path are documented in "README.developer"; TCP
desegmentation is one that isn't.