Wireshark mailing list archives
Re: Defragmenting non-tcp streams
From: Guy Harris <guy () alum mit edu>
Date: Thu, 7 Jan 2010 03:26:32 -0800
On Jan 7, 2010, at 1:48 AM, paul () wsh sbrk co uk wrote:
TCP has a tcp_dissect_pdus() function that higher protocols can use to eliminate their dependency on the TCP framing. Is there anything generic for other layers? I'm writing a USB dissector which is really a serial protocol being transported over USB.
That's http://www.nordicsemi.com/files/Product/data_sheet/User_guide_ANT.pdf right? If so, and if you're reassembling the packets in a burst transfer, this isn't a byte stream, so you can ignore the TCP dissector, and look instead at the IP dissector for an example. It's not *quite* the same as IP, as 1) you have sequence numbers rather than byte offsets, so you'd use fragment_add_seq_check() rather than fragment_add_check(); 2) the sequence number wraps around, so you'd have to keep some state and provide a "synthesized" sequence number that doesn't wrap around. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Defragmenting non-tcp streams paul (Jan 07)
- Re: Defragmenting non-tcp streams Guy Harris (Jan 07)
- Re: Defragmenting non-tcp streams paul (Jan 07)
- Re: Defragmenting non-tcp streams Guy Harris (Jan 07)
- Re: Defragmenting non-tcp streams paul (Jan 07)
- Re: Defragmenting non-tcp streams Guy Harris (Jan 07)
- Re: Defragmenting non-tcp streams paul (Jan 07)
- Re: Defragmenting non-tcp streams paul (Jan 07)
- Re: Defragmenting non-tcp streams Guy Harris (Jan 07)