#define FRAME_HEADER_LEN 8
/* This method dissects fully reassembled messages / static int dissect_foo_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_) { / TODO: implement your dissecting code */ return tvb_captured_length(tvb); }
/* determine PDU length of protocol foo */ static guint get_foo_message_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_) { return FRAME_HEADER_LEN }
/* The main dissecting routine */ static int dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { tcp_dissect_pdus(tvb, pinfo, tree, TRUE, FRAME_HEADER_LEN, get_foo_message_len, dissect_foo_message, data); return tvb_captured_length(tvb); }
Wireshark - Import raw data
raw data file: 000000 0a 01 00 00 00 00 00 10 03 0a 02 00 00 00 00 00 11 03
TCP splits it into 2 packets (i.e. 10 and 8 bytes).
Debug trace is as follows: dissect_foo() calls tcp_dissect_pdus()
tcp_dissect_pdus() calls get_foo_message_len()
get_foo_message_len() returns PDU size 8 There is 2 remaining bytes from 1st packet
The program executes dissect_foo_message. I would have expected dissect_foo() to call tcp_dissect_pdus() to reassemble the next packet. Building a 16 byte message.
The documentation for TCP reassembly is difficult to follow and it is not clear.