Wireshark-dev: Re: [Wireshark-dev] fragment_add_..(), pinfo->src/dst, IP vs. TCP Session
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 11 Jul 2010 14:39:44 -0700
On Jul 11, 2010, at 2:16 PM, David Aggeler wrote:

>>> That's what the fragment_add_seq routines are for ..
> Only the 'port numbers' are ignored,

To what port numbers are you referring?  The fragment_add_seq routines are used to reassemble data from protocols that have no port numbers.

> i.e. they are not as hierarchical 
> as they should be :-). E.g. it feels like IP-DICOM, The TCP level is 
> somewhat ignored.

The fragment_add_seq know nothing of IP or TCP, which is as it should be.

If the issue is reassembling packets from separate TCP connections separately, one solution is to have separate fragment and reassembled tables per TCP connection (or per whatever type of connection is involved).