Ethereal-dev: Re: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
Date: Mon, 13 Oct 2003 06:56:46 +1000
When DECRPC packets are reassembled, the PDU is dissected in the frame that
holds the last part of the PDU.

The PDU that starts at that offset in frame 9 is decoded in frame 11.


----- Original Message ----- 
From: Yaniv Kaul
To: ethereal-dev
Sent: Monday, October 13, 2003 12:29 AM
Subject: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment


What happens if there's more than one PDU in more than one TCP segment? It
appears that only the first PDU is dissected.

Please take a look at packet 9 of the attached capture (when enabling
desegmentation in the TCP and DCERPC protocols).
You can see that in location 0x7e8 a new DCERPC PDU begins. However, there's
no call for the DCERPC dissector to dissect it.
Could be that I don't fully understand the logic for desegmenting TCP. I'd
appreciate if someone can perhaps point to documentation on it (other than
packet-tcp.c).






_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev