Wireshark · Wireshark-dev: Re: [Wireshark-dev] Stop dissection in get_pdu_len

[Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>]

Hi,

On Thu, May 24, 2012 at 11:35:34AM -0400, Tobias Weiss wrote:
> I'm using tcp_dissect_pdus() to reassemble packets in my dissector. One of
> my functions will calculate the length of the real message based on a
> header with a fixed length (get_pdu_len function pointer). But what is the
> best way to stop the dissection in get_pdu_len if I figured out that the
> header is invalid? I could just return 0 which would result in a call to
> show_reported_bounds_error(), but is that the best way to report the error?

You can't. But you can check header before calling tcp_dissect_pdus().
But it'd be good to have some tcp_dissect_pdus_heur(), feel free to write one :-)

Cheers,
 Kuba.