Wireshark · Wireshark-dev: Re: [Wireshark-dev] Reassemble packets decoding - not proper

["Rach, Darshan" <DarshanR@xxxxxxx>]

Hi

 

Regarding the 2nd point, I tried as you have suggested. But in vain :(

Let me explain what I am trying to do in detail:

 

Currently, I am able to display fragments as shown in the below picture.

 

In the picture, there is also “Fragment 12” in the packet list. But, that fragment is not shown, and instead, “Message Reassembled” is being displayed.

I am looking for something like this: Display “Fragment 12” and then in the next line, display “Reassembled Message”.

Is it possible that way?

 

 

 

 

Regards,

Darshan

 

 

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx]
Sent: Wednesday, December 09, 2009 1:51 AM
To: Rach, Darshan
Cc: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Reassemble packets decoding - not proper

 

 

On Dec 8, 2009, at 2:33 AM, Rach, Darshan wrote:

 

> Two queries.

> 1. Is it possible to display the actual payload in place of 

> "Fragment data"? (please see the mail chain below for reference)

 

What do you mean by "display the actual payload"?

 

> 2. If the packets are fragmented, the last fragment is not shown and 

> instead, shows "Message Reassembled". How is it possible to display 

> even the last fragment as "Fragment n" and then, next, display the 

> reassembled packet.

 

Try something such as this:

 

                        if(((block_number == 0) && (last_packet_flag == 0)) ||

                           (block_number > 0))

                        {

                              /*darshan*/

                              pkt->fragmented = TRUE;

 

                              /* Add this fragment to the protocol tree. */

                              proto_tree_add_text(oqtp_tree, tvb, packet_field_offset, -1, 

"Fragment data");

 

                              frag_msg = fragment_add_seq_check(tvb, packet_field_offset, pkt,

                                                                                msgid, /* ID for fragments belonging together */

                                                                                msg_fragment_table, /* list of message fragments */

                                                                                msg_reassembled_table, /* list of reassembled messages */

                                                                                block_number, /* fragment sequence number */

                                                                               tvb_length_remaining(tvb, packet_field_offset), /*

fragment length - to the end */

                                                                                !last_packet_flag); /* More fragments? */

 

                              new_tvb = process_reassembled_data(tvb, packet_field_offset, pkt,

                                                                                 "Reassembled OQTP Message",

                                                                                 frag_msg,

                                                                                 &msg_frag_items,

                                                                                 NULL,

                                                                                 oqtp_tree);

 

                              /* Reassembled */

                              if (frag_msg)

                              {

                                    col_append_str(pkt->cinfo, COL_INFO,

                                                         "(Reassembled OQTP Response)");

                              }

                              else

                              {

                                    /* Not last packet of reassembled short message */

                                    col_append_fstr(pkt->cinfo, COL_INFO,

                                                            "(OQTP fragment %u)", block_number);

                              }

 

                              if (new_tvb) /* take it all */

                              {

                                    next_tvb = new_tvb;

                              }

                              else

                              {

                                    /* We cannot dissect anything yet, as we don't have a

reassembled packet */

                                    next_tvb = NULL;

                              }

                        }

                        else

                        {

                              next_tvb = tvb_new_subset(tvb, packet_field_offset, -1, -1);

                        }

 

                        /*restoring fragmented state*/

                        pkt->fragmented = save_fragmented;

 

                        if (next_tvb != NULL)

                        {

                              /* Not a fragment, or fragments were reassembled */

                              packet_field_offset = 0;

 

                              /*Request Satisfied*/

                              request_satisfied = tvb_get_guint8(tvb, packet_field_offset);

                              proto_tree_add_uint(oqtp_tree, hf_request_satisfied, tvb,

packet_field_offset, 1, ((request_satisfied & 0x80) >> 7));

 

                              /*Reserved_for_future_use*/

                              reserved_for_future_use = ((tvb_get_guint8(tvb,

packet_field_offset)& 0x7E) >> 1);

                              proto_tree_add_uint(oqtp_tree, hf_reserved_for_future_use, tvb,

packet_field_offset, 1, reserved_for_future_use );

 

                              /*No Extended pd syntax*/

                              no_extended_pd_syntax = (tvb_get_guint8(tvb, packet_field_offset)

& 0x1);

                              proto_tree_add_uint(oqtp_tree, hf_no_extended_pd_syntax, tvb,

packet_field_offset, 1, no_extended_pd_syntax );

                              packet_field_offset += 1;

 

                              /*Number of classifications*/

                              proto_tree_add_item(oqtp_tree, hf_num_classifications, tvb,

packet_field_offset, 1, FALSE);

                              num_classifications = tvb_get_guint8(tvb, packet_field_offset);

                              packet_field_offset += 1;

 

                              for(loop_index = 0 ; loop_index < num_classifications ; +

+loop_index)

                              {

                                    ...

                              }

 

                                    ...

                        }

 

                        break;

 

---

This message is confidential and intended only for the addressee. If you have received this message in error, please immediately notify the postmaster@xxxxxxx and delete it from your system as well as any copies. The content of e-mails as well as traffic data may be monitored by NDS for employment and security purposes.
To protect the environment please do not print this e-mail unless necessary.

An NDS Group Limited company. www.nds.com