Ethereal-dev: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Yaniv Kaul <ykaul@xxxxxxxxxxxx>
Date: Sun, 12 Oct 2003 16:29:49 +0200
What happens if there's more than one PDU in more than one TCP segment? It appears that only the first PDU is dissected.

Please take a look at packet 9 of the attached capture (when enabling desegmentation in the TCP and DCERPC protocols).
You can see that in location 0x7e8 a new DCERPC PDU begins. However, there's no call for the DCERPC dissector to dissect it.
Could be that I don't fully understand the logic for desegmenting TCP. I'd appreciate if someone can perhaps point to documentation on it (other than packet-tcp.c).

Attachment: dcerpc-seg.cap
Description: Binary data