Re: Reassemble packets decoding - not proper

[Guy Harris <guy () alum mit edu>]

On Dec 8, 2009, at 2:33 AM, Rach, Darshan wrote:

> Two queries.
> 1. Is it possible to display the actual payload in place of  
> "Fragment data"? (please see the mail chain below for reference)

What do you mean by "display the actual payload"?

> 2. If the packets are fragmented, the last fragment is not shown and  
> instead, shows "Message Reassembled". How is it possible to display  
> even the last fragment as "Fragment n" and then, next, display the  
> reassembled packet.

Try something such as this:

                                if(((block_number == 0) && (last_packet_flag == 0)) ||
                                   (block_number > 0))
                                {
                                        /*darshan*/
                                        pkt->fragmented = TRUE;

                                        /* Add this fragment to the protocol tree. */
                                        proto_tree_add_text(oqtp_tree, tvb, packet_field_offset, -1,  
"Fragment data");

                                        frag_msg = fragment_add_seq_check(tvb, packet_field_offset, pkt,
                                                                                                          msgid, /* ID 
for fragments belonging together */
                                                                                                          
msg_fragment_table, /* list of message fragments */
                                                                                                          
msg_reassembled_table, /* list of reassembled messages */
                                                                                                          block_number, 
/* fragment sequence number */
                                                                                                         
tvb_length_remaining(tvb, packet_field_offset), /*
fragment length - to the end */
                                                                                                          
!last_packet_flag); /* More fragments? */

                                        new_tvb = process_reassembled_data(tvb, packet_field_offset, pkt,
                                                                                                           "Reassembled 
OQTP Message",
                                                                                                           frag_msg,
                                                                                                           
&msg_frag_items,
                                                                                                           NULL,
                                                                                                           oqtp_tree);

                                        /* Reassembled */
                                        if (frag_msg)
                                        {
                                                col_append_str(pkt->cinfo, COL_INFO,
                                                                           "(Reassembled OQTP Response)");
                                        }
                                        else
                                        {
                                                /* Not last packet of reassembled short message */
                                                col_append_fstr(pkt->cinfo, COL_INFO,
                                                                                "(OQTP fragment %u)", block_number);
                                        }

                                        if (new_tvb) /* take it all */
                                        {
                                                next_tvb = new_tvb;
                                        }
                                        else
                                        {
                                                /* We cannot dissect anything yet, as we don't have a
reassembled packet */
                                                next_tvb = NULL;
                                        }
                                }
                                else
                                {
                                        next_tvb = tvb_new_subset(tvb, packet_field_offset, -1, -1);
                                }

                                /*restoring fragmented state*/
                                pkt->fragmented = save_fragmented;

                                if (next_tvb != NULL)
                                {
                                        /* Not a fragment, or fragments were reassembled */
                                        packet_field_offset = 0;

                                        /*Request Satisfied*/
                                        request_satisfied = tvb_get_guint8(tvb, packet_field_offset);
                                        proto_tree_add_uint(oqtp_tree, hf_request_satisfied, tvb,
packet_field_offset, 1, ((request_satisfied & 0x80) >> 7));

                                        /*Reserved_for_future_use*/
                                        reserved_for_future_use = ((tvb_get_guint8(tvb,
packet_field_offset)& 0x7E) >> 1);
                                        proto_tree_add_uint(oqtp_tree, hf_reserved_for_future_use, tvb,
packet_field_offset, 1, reserved_for_future_use );

                                        /*No Extended pd syntax*/
                                        no_extended_pd_syntax = (tvb_get_guint8(tvb, packet_field_offset)
& 0x1);
                                        proto_tree_add_uint(oqtp_tree, hf_no_extended_pd_syntax, tvb,
packet_field_offset, 1, no_extended_pd_syntax );
                                        packet_field_offset += 1;

                                        /*Number of classifications*/
                                        proto_tree_add_item(oqtp_tree, hf_num_classifications, tvb,
packet_field_offset, 1, FALSE);
                                        num_classifications = tvb_get_guint8(tvb, packet_field_offset);
                                        packet_field_offset += 1;

                                        for(loop_index = 0 ; loop_index < num_classifications ; + 
+loop_index)
                                        {
                                                ...
                                        }

                                                ...
                                }

                                break;

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe