Ethereal-dev: Re: [Ethereal-dev] displaying multiple pdu's in one packet as multiple packets f

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Wed, 21 Jun 2006 20:16:30 +0200
Durnford, Robin (EXP) wrote:
I have been writing a dissector and recently implemented the tcp_dissect_pdus function when I noticed some of my messages were longer than the length field. The pdu dissection works great except that you have to select the message with multiple pdus in the summary before you notice there are multiple pdus in the packet. To tcp these packets look like one message and are therefore one row in the summary window, but to the people who will be using the dissector and looking for a particular message at a glance these pdus are actually 2 or more different messages.
That's a common problem. For example, I've seen up to 12! DCE/RPC requests in a single TCP packet. 

The solution I've implemented is to "show" this in the Info column.
I've found the set_fence() function may help in this regard (can't remember the exact function name), it prevents the info column from being cleared at the beginning of the dissector (as your dissector will be called more than once). 

Regards, ULFL
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev