Wireshark · Ethereal-dev: {RE: [Ethereal-dev] Is Skinny Segmented?

["Rami AlHasan" <Rami.AlHasan@xxxxxxxxxxxx>]

Ok, thanks again. 

I checked the Skinny dissection code. I saw that you call
tcp_dissect_pdus in the dissect_skinny function.

I had some problem understanding what is done exactly to reassemble the
segmented messages.

Assume that I have one skinny message segmented into two packets as
follows:

SKINNY-MESSAGE 
{

	Header
	{
		Size = 48
		Reserved = 0
	}
	Data
	{
		MessageID = 0x1
		Message-Data = stream of (48 - 12 = 36 bytes)
	}
}

Assume also first TCP packet payload length is 12 and the second TCP
packet payload is 36.

Here when I check for the Skinny Size field I will find it bigger than
the payload. I have to wait for the next packet to take the remaining
bytes.

1- Where do Ethereal store the first packet 12 bytes until it gets the
rest?
2- How does ethereal link segmented packets from the packets dump, does
it check for src and dest and seq number?
2- When I get the second TCP packed should I read directly from payload
assuming that this my required segment. i.e. without header checking
issues as in the normal start of skinny validation.

Regards,
Rami.AlHasan