Wireshark · Ethereal-dev: RE: [Ethereal-dev] help with broken-up messages running atop TCP?

[nak26 <nak26@xxxxxxxxxx>]

thanks for the quick response, and directions.
I tried it, but I still get a "short frame" exception.

>>Many binary protocols running atop TCP have a header, early in the
>>message, that specifies the size of the message.

yeah..., my header has a field, specifying the size of the message (including 
the header)...in the cases when the message gets brokenup, the size reported 
in the header is bigger that the length of the tvb.

>For those protocols, you can usually use the "tcp_dissect_pdus()"
>routine, which takes, as arguments:

I did call this function passing all the required arguments, but still got the 
"short frame" message. I stepped (ddd) through the code - tcp_dissect_pdus() 
calls  my message_dissector (I have a broken-up message captured with 
tcpdump), passing a tvbuff with a length N, and N < M, where M is the length 
that the header is reporting (the differense N-M is sent in subsequent TCP 
packets). And of course my message dissector goes out of bounds - BoundsError 
exception is thrown, and finally ReportedBoundsError exception is thrown, 
which I believe displays "short frame".

What Am I doing wrong?
Thanks a lot for any suggestions.
-Nik