Ethereal-dev: RE: [Ethereal-dev] [PATCH] Q.931 fails to pass long message to H.225

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Anders Broman (AL/EAB)" <anders.broman@xxxxxxxxxxxx>
Date: Tue, 22 Nov 2005 09:03:26 +0100
Hi,
Should the TCP dissector realy supress desegmentation if the checksum is
faulty?

Brg
Anders 

-----Original Message-----
From: ethereal-dev-bounces@xxxxxxxxxxxx
[mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: den 21 november 2005 20:18
To: Ethereal development
Subject: [Ethereal-dev] [PATCH] Q.931 fails to pass long message to
H.225

Hi list,

Revisiting the Q.931 dissector I made a new patch which clears out the
following situation.

A long Q.931 message was sent from a host which offloaded part of the
TCP/IP processing to the network card. Since the resulting frame was
longer than 1514 octets it falls in two parts. This invalidated the TCP
checksum. The TCP dissector can detect this, when this feature is
enabled.
See the attached capture file.

With a detected invalid TCP checksum desegmentation is supressed. So the
information element length is larger than the actual remaining size of
the TVB. This results in a failure when a tvb_new_subset is created to
pass to the H225 dissector.

The attached patch limits the information element length in case
desegmentation is turned off/supressed, so a valid tvb_subset can be
created and dissection can continue longer.

Thanx,
Jaap