Wireshark · Ethereal-dev: Re: [Ethereal-dev] Reassembling out of order packets

[Jerry Talkington <jtalkington@xxxxxxxxxxxxxxxxxxxxx>]

On Thu, Oct 28, 2004 at 01:56:31PM -0400, Ian Schorr wrote:
> Is the protocol over TCP, and are you using tcp_dissect_pdus() call to 
> do the reassembly?

It's HTTP over TCP.  My understanding is that tcp_dissect_pdus()
requires the length of the pdu to be determined within X bytes of the
packet, but with HTTP there is no way to know how big the data is until
you've processed the headers, which could be any number of bytes
themselves.
 
> If not, what logic are you using (or expecting) to handle the 
> reassembly?
 
After the headers have been processed, then either a Content-Length was
given, and that reassembles fine, or the data is chunked.  Each chunk of
data has a header that says how big the chunk is, then a trailer.

If there isn't enough data in the tvb, then desegment_offset and
desegment_len get set, and FALSE is returned to cause another call
to req_resp_hdrs_do_reassembly().

When the packets are out of order, the subsequent calls to
req_resp_hdrs_do_reassembly() fail, since the bounding is all hosed.

req_resp_hdrs_do_reassembly() needs to be revisted anyway, since it
seems to cause a huge performance hit when loading large HTTP responses.

Is there any way to get more bytes from a stream besides setting
desegment_offset/desegment_len and returning?  I don't have any numbers,
but reparsing all of the data every time can't be good for
performance...

-- 
GPG public key:
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x9D5B8762