Wireshark mailing list archives
Re: Stop dissection in get_pdu_len
From: Tobias Weiss <tweiss () ra rockwell com>
Date: Thu, 24 May 2012 14:18:36 -0400
Hi, Jakub Zawadzki wrote on 05/24/2012 01:02:40 PM:
tcp_dissect_pdus() splits one big tvb into smaller ones. No big magic. So it should be possible to write something like: bool dissect_heur(tvb, pinfo, tree) { offset = 0; while (tvb_reported_length_remaining(tvb, offset) > minimal_packet_len)
{
if (!valid_header) return FALSE; offset += your_proto_get_pdu_len(pinfo, tvb, offset); } tcp_dissect_pdus(tvb, pinfo, tree, ..., your_proto_get_pdu_len, your_proto_dissect_pdu) return TRUE; } It's better to copy whole tcp_dissect_pdus() semantic, that's why I proposed you to write new function.but what should I do if I can? Currently I'm callingexpert_add_info_* and return without doing anything.But in this case the user does not even see a warning as long ashe does not open the ExpertInfo window.Well if it's heurestic dissector just return, if it's not you probably don't need to test it :)
I just read about heuristic dissectors after you mentioned them. While reading the README.heuristig I figured out that instead of using create_dissector_handle() I would be better off with new_create_dissector_handle(). The only reason I'm using tcp_dissect_pdus() is because sometimes my messages are split over 2 or more TCP frames. I guess using new_create_dissector_handle() and returning a negative value in that case would be 1) much easier and 2) a bit faster, right?? Thanks! Tobi ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Stop dissection in get_pdu_len Tobias Weiss (May 24)
- Re: Stop dissection in get_pdu_len Jakub Zawadzki (May 24)
- Re: Stop dissection in get_pdu_len Bill Meier (May 24)
- Re: Stop dissection in get_pdu_len Bill Meier (May 24)
- Re: Stop dissection in get_pdu_len Tobias Weiss (May 24)
- Re: Stop dissection in get_pdu_len Jakub Zawadzki (May 24)
- Re: Stop dissection in get_pdu_len Tobias Weiss (May 24)
- Re: Stop dissection in get_pdu_len Tobias Weiss (May 24)
- Re: Stop dissection in get_pdu_len Bill Meier (May 24)
- Re: Stop dissection in get_pdu_len Jakub Zawadzki (May 24)