This is our old Q&A Site. Please post any new questions and answers at

I have created a dissector for a line-based protocol but have some problems when data are bigger than packet size. When the data is too big, I need to reassemble a number of packets to have a complete data before processing it. Here you can find a part of my dissector. I need your help for if (packet_end != 0x0A){} else {}. I don't know how proceed and what functions to use for reassembling packets.

static void dissect__textbasedprotocol(tvbuff_t *tvb, packet_info *pinfo,
                                       proto_tree *tree)
    guint8 packet_end = 0;
    tvbuff_t *working_tvb = NULL;
    gint offset_actu = 0;
    packet_end = tvb_get_guint8(
        tvb, tvb_reported_length_remaining(tvb, offset_actu) - 1);
    if (packet_end != 0x0A) // end of this packet is NOT end of data
    } else {
        working_tvb = tvb; // packet contain an complete data \n and terminated.
    while (tvb_reported_length_remaining(working_tvb, offset_actu) > 0) {
        // Dissector work with complete command \n terminated.

asked 06 Apr '11, 09:34

Thibault's gravatar image

accept rate: 0%

edited 03 Jul '14, 10:53

Lekensteyn's gravatar image


When you have to reassemble payload of a protocol without a length header, you should use the point 2.7.2 Modifying the pinfo struct. of the README.developer.

BTW: this section has a code fragment, that works with strings terminated by a '\0'. Try toreplace '\0' by '\n'.

permanent link

answered 07 Apr '11, 23:16

harper's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 06 Apr '11, 09:34

question was seen: 4,299 times

last updated: 03 Jul '14, 10:53

p​o​w​e​r​e​d by O​S​Q​A