On Tue, Sep 17, 2002 at 11:23:27PM +0000, didier wrote:
> If the packet is malformed bail out early (before allocating 32000
> subtrees for example).
Checked in, along with a couple of fixes to other problems I found when
looking at your change.
> BTW How do I do if I want to reset a conversation eg:
> in the same capture:
> A)
> ip1:pt1 --> ip2:pt2
> ip1:pt1 --> ip2:pt2 <RST>
> some stuff
> B)
> ip1:pt1 --> ip2:pt2 <SYN>
> ....
> now A and B are in the same conversation
Currently, you can't. There is currently no mechanism in Ethereal to
support more than one conversation with the same endpoint addresses and
port numbers; such a mechanism would have to be added.
Such a mechanism would have to somehow arrange that more than one
conversation with the same endpoint addresses and port numbers exist,
and that the conversations be distinguished by something such as ranges
of frame numbers, so that a query searching for a conversation would
also take a frame number as an argument, and only a conversation whose
range of frame numbers includes that frame would be found. The frame
number argument would probably be the frame number of the frame being
dissected.
In addition, the TCP dissector would have to "close" a conversation
either when it detects that a TCP connection has ended or that a new
connection has started.
