Wireshark-dev: Re: [Wireshark-dev] How to handle duplicate fragments for a plugin written on to
On Apr 7, 2009, at 4:20 PM, siri m wrote:
I have few questions with regards to eliminating the duplicate
fragments for a plugin written on top of UDP.
Q1: I would like to know how we can obtain UDP CRC from within the
custom plugin written on top of UDP? I tried to get the checksum by
providing a negative offset(-2) to tvb_get_ntohs(tvb, offset), but
that doesn't work. Is there any other way to obtain the UDP CRC from
within my plugin?
No, there isn't.
On the other hand, if you can't detect duplicate fragments any other
way (as per my previous mail, presumably the process that's receiving
the fragments has to be able to detect them), you could compute some
form of hash yourself (UDP checksum - I wouldn't call it a "CRC" as
it's not a cyclic redundancy check - MD5 hash, etc.) on the data plus
the source and destination addresses and port numbers (which *are*
available as pinfo->src, pinfo->dst, pinfo->srcport, and pinfo-
>dstport) and use *that* to detect duplicates. (I don't know whether
an Internet checksum would be sufficiently strong to avoid having too
many "false positives" for duplicates.)
