Reassembled data in custom dissector

Hi Afrim,

Thanks for the reply . Got it, Thanks. for my protocol only one beginning of message and may be multiple continuation of message and 1 end of message. Now i have gone through many protocols to understand how to add the data into reassemble table. As iam new to this , could you help me to guide step by step procedure to add data to table and display in a separate tab like in the image. when it comes to end of message!

         Packet 1 : fragmentation,                         beginning of message
     Packet 23 : fragmentation, continuation of message
     Packet 44 : fragmentation, continuation of message
     Packet 57 : fragmentation, continuation of message
     Packet 69 : fragmentation,                           end of message</code></pre></div><div id="comment-37032-info" class="comment-info"><span class="comment-age">(14 Oct '14, 03:11)</span> <span class="comment-user userinfo">umar</span></div></div><span id="37037"></span><div id="comment-37037" class="comment"><div id="post-37037-score" class="comment-score">1</div><div class="comment-text"><p><span>@mrajsekar</span></p><p>Unfortunately all the protocols that do reassembly in this way are somewhat complicated, if you search for all files in epan\dissectors that include <code>fragment_add_seq_next</code>, you will see all the current dissectors that use the method you need. Try looking at those, but be aware they are all likely to have a lot of "extras" that you'll have to work through.</p><p>You'll need to understand "conversations" (README.dissector sect 2.2) and reassembly (in epan\reassemble.h) to complete your dissector.</p><p>I think you need to use <code>fragment_add_seq_next</code> as you don't have a fragment id, so must assume all fragments come in order, first to last.</p></div><div id="comment-37037-info" class="comment-info"><span class="comment-age">(14 Oct '14, 05:27)</span> <span class="comment-user userinfo">grahamb ♦</span></div></div><span id="37046"></span><div id="comment-37046" class="comment not_top_scorer"><div id="post-37046-score" class="comment-score"></div><div class="comment-text"><p>Thanks Grahamb!I will try this.</p></div><div id="comment-37046-info" class="comment-info"><span class="comment-age">(14 Oct '14, 18:49)</span> <span class="comment-user userinfo">umar</span></div></div><span id="37326"></span><div id="comment-37326" class="comment not_top_scorer"><div id="post-37326-score" class="comment-score"></div><div class="comment-text"><p>Hi, What is the difference between conversation and reassembly and fragmentation???</p><p>for me iam developing dissector to ruunnning on top of UDP port XXXX and my PDU data comes in many packets..</p><p>Not from other destination port..</p><p>Can you please Clarify?</p><p>for me i have beginning of message in that i have a data length field : ex. 24 bytes in that beginning of message contains 15 Bytes pdu data</p><p>continuation of message contains 5 bytes and another continuaton of message contains 2 bytes and then End of Message contains 2 bytes.</p><p>How can i achieve this reassembly . using conversation or using reassembly??</p><p>i have gone through RTP and some other files but i get confuse with it. please help me on this</p><p>Thanks</p></div><div id="comment-37326-info" class="comment-info"><span class="comment-age">(24 Oct '14, 01:17)</span> <span class="comment-user userinfo">umar</span></div></div><span id="37328"></span><div id="comment-37328" class="comment"><div id="post-37328-score" class="comment-score">1</div><div class="comment-text"><p>Fragmentation (and subsequent reassembly) occurs when an application pdu can be split across multiple transport layer segments, e.g. your pdu arrives split over multiple tcp segments. The application dissector can tell the tcp dissector how much data it needs (read from the application pdu header) and the tcp dissector then reassembles incoming data until it has enough to hand back to the application dissector. Wireshark has built-in support for tcp reassembly, for other transport protocols the application dissector will have to manage reassembly itself.</p><p>Conversation is where the application dissector may be interested in multiple application pdu's, e.g request\response.</p></div><div id="comment-37328-info" class="comment-info"><span class="comment-age">(24 Oct '14, 02:01)</span> <span class="comment-user userinfo">grahamb ♦</span></div></div><span id="37331"></span><div id="comment-37331" class="comment not_top_scorer"><div id="post-37331-score" class="comment-score"></div><div class="comment-text"><p>Should i add id to each byte of the data ? please help me on this i really could not understand this. i got stuck in this for long time. i have completed 95% of the dissector and once i did this i can complete my work.</p></div><div id="comment-37331-info" class="comment-info"><span class="comment-age">(24 Oct '14, 02:42)</span> <span class="comment-user userinfo">umar</span></div></div><span id="37368"></span><div id="comment-37368" class="comment not_top_scorer"><div id="post-37368-score" class="comment-score"></div><div class="comment-text"><p>Is this code will satisfy my requirement?<br />

      dissect_proto(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
        while [bytes remain in tvb from offset]
            if [pdu length is unknown]
        found = fragment_get(pinfo, 0, fragment_table);
        if [fragment was found]
            [loop through found->next and add total_length and data]
            buffer = tvb_new_real_data(data, total_length, total_length);
        else
            buffer = tvb_new_subset(tvb, offset, ...);
    bytes_available = tvb_length(buffer);
    pdu_length = get_pdu_length(buffer, &amp;pdu_offset);
    if [pdu length is known and is smaller than bytes remaining]
        complete = TRUE;
    /* bytes_to_consume is min(pdu_length, bytes_available) */
    pinfo-&gt;fragmented = !complete;
    head = fragment_add(tvb, offset, pinfo, 0, fragment_table,
            offset, bytes_to_consume, !complete);
    next_tvb = process_reassembled_data(tvb, offset,                             pinfo, &quot;Reassembled packet&quot;, head, &amp;proto_frag_items, NULL, tree);
    offset += bytes_to_consume;</code></pre></div><div id="comment-37368-info" class="comment-info"><span class="comment-age">(26 Oct '14, 23:34)</span> <span class="comment-user userinfo">umar</span></div></div><span id="37371"></span><div id="comment-37371" class="comment"><div id="post-37371-score" class="comment-score">1</div><div class="comment-text"><p>I don't really understand the purpose of your while loop and I think in your case you dont need conversation interface.So, as Grahamb said, assuming your data comes in order you dont need an ID, then use fragment_add_seq_next().<br />

Here is the prototype of this function
fragment_head 
fragment_add_seq_next(reassembly_table table, tvbuff_t tvb, const int offset,
              const packet_info pinfo, const guint32 id,
              const void *data, const guint32 frag_data_len,
              const gboolean more_frags);
So you got the reassembly table, tvb buffer, the current offset, pinfo structure, as you dont need ID I would have set it to 0 (or any other value), set data* to NULL, frag_data_len is the length of your fragment and more_frag is a flag to tell if there is more fragment to wait. You got all these information so just fill in.