This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the problem with reassembling in this pcap?

0

I'm developing a subdissector under SSL. When I test it, I found that most of the packets are dissected properly where some of them are dissected as "Ignored Unknown Record". I noticed these cases get (always) properly dissected: a single PDU embedded in a single SSL frame or multiple PDUs embedded in a single SSL frame. However, the case where a single PDU is a crosse multiple SSL frames is not (attached screenshot)! Dissection works fine if the next involved frame is a reassembled one (looks as "Application Data" in the Info column) but fails when it is a "[TCP segment of a reassembled PDU]".

W]hen I tried to dissect the same dump without the related decryption keys, I found that the packets which appear as "[TCP segment of a reassembled PDU]" are the ones which dissected as"Ignored Unknown Record" when I use the keys.

Based on that, I can only think there is something wrong with the reassembling but I'm not sure where?

Here is my relate dump (no keys provided!)

Part of My ssl_debug_file

 avialble =548 
 required = 514 
 Yes we have enough bytes for #310 
 done dissecting 
 avialble =34 
 required = 514 
No enough bytes for #310 we need 480 more

dissect_ssl enter frame #312 (first time) packet_from_server: is from server - TRUE conversation = 0x7fb399607058, ssl_session = 0x7fb3721867e0 record: offset = 0, reported_length_remaining = 1368 Unknown Record because of the session version is 3 and the returned type is 206

dissect_ssl enter frame #313 (first time) packet_from_server: is from server - TRUE conversation = 0x7fb399607058, ssl_session = 0x7fb3721867e0 record: offset = 0, reported_length_remaining = 1368 Unknown Record because of the session version is 3 and the returned type is 133

alt text

asked 04 Aug ‘15, 09:18

flora's gravatar image

flora
156313338
accept rate: 100%

edited 05 Aug ‘15, 05:54