Wireshark-dev: Re: [Wireshark-dev] Copying TVBs for Reassembly [Was: Filebacked-tvbuffs : GSoC'
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Apr 2013 15:22:07 -0700
On Apr 18, 2013, at 1:40 PM, Evan Huus <eapache@xxxxxxxxx> wrote:

> The reassembly code could then add meta-data to this when
> reassembling, and the tvb could lazily refetch the underlying tvbs
> using the existing wiretap interface?

Lazily *regenerate* the underlying tvbs.

The "bottom-level" tvbs would be regenerated by reading packet data from the file.

However, there might be "intermediate-level" tvbs that do *not* contain data directly fetched from a file; instead, the data might have been decompressed, or decrypted, or de-encoded from base-64, or otherwise processed.  Consider a packet reassembled from 3 lower-leel chunks, the first of which came from a base-64 decoding of still lower-level data reassembled from 5 even lower-level decrypted packets....