This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Fragmentation problems

0

I'm facing several problems on handling fragmented packets. Actually I have a packet with a 0x8F length, that comes in 2 parts, the first one with 0x72, the second with the rest of the packet with some extra bytes (The total size as well the fragment size can change , but I think my problem is not that).

What I'm doing is:

save_fragmented = pinfo->fragmented;
fragment_data *frag_msg = fragment_add_seq_check ( tvb, 1, pinfo, nRXCounter, //Key of the packet
iso7816_fragment_table, 
iso7816_reassembled_table,
nFrameCounter, // guint32 fragment sequence number starting with value 1
tvb_length(tvb),
FALSE);
if (frag_msg) /* Reassembled */
{ 
 col_append_str(pinfo->cinfo, COL_INFO," R E A S S E M B L E D ");
}
else /* Not last packet of reassembled Message */
{
 col_append_fstr(pinfo->cinfo, COL_INFO," (Message fragment # %u)", nFrameCounter++);
}

I thought that by passing the last argument as FALSE it would stop the fragmentation and set the frag_items with the tvb data for the two incoming packets, but it doesn't happen. Instead of give me the frag_msg with some data to be reassembled, it consider that the packet is still being fragmented and the Wireshark shows "Message fragment #1"",2,3" and so on...

My doubst are: Is the 8th argument the length of the REMAINING size of the total 8F? Or is the size of the fragment being passed to the function at that time? e.g: Since the total size is 8F, in the first fragment(that has a 0x72 length) i should pass the 0x72 value or a 0x8F-0x72 value? The last argument, should be false or true to STOP the fragmentation and answer with the fragmented data until that moment?? The developers guide is not so clear at this point, so I will be grateful if anyone can help me.

Regards,

Francesco

asked 23 Jan '12, 07:15

Tchesko's gravatar image

Tchesko
1112
accept rate: 0%

edited 23 Jan '12, 07:18