This is a static archive of our old Q&A Site. Please post any new questions and answers at

Reassembling TCP fragments doesn’t reassemble some packets


I wrote a dissector named PROTOC.

for some reasons this dissector doesn't reassemble all of the protocol's packets which can be found as [TCP segment of a reassembled PDU], But there is no trace to the reassembled PDU. Example can be seen at the attached link below of the .pcap, where TYPE D is shown at the beginning of the file (type 4)(line 1 or 3), and TYPE E cannot be shown at the end of the file (type 5)(line 6312)

I uploaded the .pcap I'm using in order to debug my protocol here (I made this .pcap shorter, but it shows the same results on the original .pcap version, and on other .pcaps also) and the source of my protocol here (DOWNLOADING PASSWORD: "wireshark")

My protocol format is:

  • 4 bytes of type
  • 4 bytes of length
  • 256 bytes of something called "context id"
  • length bytes of data

I compiled it on wireshark version 1.8.4, using x64 compiler. "Setting environment for using Microsoft Visual Studio 2010 x64 cross tools"

Compiling the dissector:

  1. get into "cmd" and writes call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat"

or for 64bit

call "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86_amd64

  1. compile the dissector (in the dissector directory) nmake -f Makefile.nmake

Any help will be very appreciated Thanks

asked 02 Apr '13, 00:15

hudac's gravatar image

accept rate: 50%

edited 11 Apr '13, 02:24