Wireshark-dev: Re: [Wireshark-dev] Why am I getting a BoundsError?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Wed, 25 Oct 2006 21:02:36 -0400
Maybe I don't understand tcp_dissect_pdus.
If a user message overruns an ethernet frame, tcp_dissect_pdus is supposed to allocate enough space to hold the entire user message, and only call the user's dissector when the entire message has been received... right? 
So if we get a frame with user packet lengths
	1056	--> parsed here, since frame has 1448 TCP bytes (right?)
	112	--> "", total now 1168
	1868	--> Parsed later. total size would be 3036
when wireshark gets third packet, it should allocate a buffer big enough to handle it (right?), then wait for enough data to arrive before doing so, right?
In fact, 2 more frames would be requires since in first frame only 280 of 1868 bytes are parsed, leaving 1608 bytes, requiring two more frames?