This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am able to reassemble fragments successfully if there is a complete message. However if there are missing fragments my dissector continues to reassemble the next message along with the message that has the missing fragments. I can calculate how many fragments there are supposed to be before I begin reassembly but my first indication that there are missing fragments is when I come across the initial frame for the next fragmented packet. Is there a way that I can tell my reassembly to immediately stop reassembling at the previous fragment and begin a new reassembly at the current initial fragment. Either that or can I look at the next future packet to check if it is the next fragment or an initial fragment to another message?

asked 09 Jun '17, 08:58

jpetersen's gravatar image

jpetersen
6335
accept rate: 0%


The new fragment sequence should be using a new sequence id, so that the original sequence is left unreassembled.

permanent link

answered 09 Jun '17, 10:06

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

1

Thank you that worked.

For anyone facing a similar problem: I didn't have any sequence ID info in the header for the file so I just used the frame number of the initial fragment for my sequence ID.

(09 Jun '17, 11:33) jpetersen
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×78
×31
×30
×27

question asked: 09 Jun '17, 08:58

question was seen: 1,008 times

last updated: 09 Jun '17, 12:54

p​o​w​e​r​e​d by O​S​Q​A