This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all; We have developed a dissector to analyze a log file filled with TCP packets. Each packet contains one or more messages that are previously specified with starting and ending keywords(bytes).

But we faced with a problem. Some messages starts at the end of a packet and continues at the start of the next packet. How can we combine these two parts of bytes and then apply dissection on it?

Anyone has an experience with that kind of case?

Thanks in advance.

asked 16 May '13, 01:26

barisalis's gravatar image

barisalis
16337
accept rate: 100%


What you need is reassembly. There are two ways of doing this:

  1. Use tcp_dissect_pdus() when you can determine the total length of the PDU within a fixed amount of bytes at the beginning of your PDU.
  2. Modify the pinfo struct to tell the TCP dissector to collect more data.

Both options are described in par 2.7 of README.developer

If you need more info or help after reading README.developer, feel free to ask :-)

permanent link

answered 16 May '13, 02:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 16 May '13, 02:08

For our case; 1) Packet sizes are not fixed. (Packets can contain one or more than one messages inside.) 2) Message lengths are not fixed. (Different lengths for different messages)

So I think we should work on the second option (Modify the pinfo struct to tell the TCP dissector to collect more data.).

What you suggest further?

(16 May '13, 03:27) barisalis

Can you determine the length of each PDU by reading some part of the header of the PDU? If so, then use tcp_dissect_pdus(). If not, i.e. you have to read to the end of the pdu to determine its length then the 2nd method should be used.

(16 May '13, 03:35) grahamb ♦

Thanks!! we can see the result as below. But we wonder if there is any way to dissect this reassembled PDU.


2 Reassembled TCP Segments (160 bytes): #5641(20), #5643(140)

Frame: 5641, payload: 0-19 (20 bytes)

Frame: 5643, payload: 20-159 (140 bytes)

Segment count: 2

Reassembled TCP length: 160

(16 May '13, 04:08) barisalis

The problem is perfectly solved. Thanks for your quick help.

(16 May '13, 04:58) barisalis
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×637
×27
×21
×3

question asked: 16 May '13, 01:26

question was seen: 3,302 times

last updated: 16 May '13, 04:58

p​o​w​e​r​e​d by O​S​Q​A