1 | initial version |
This is known as reassembly. Data from multiple frames is accumulated for reassembly and then when all parts are present a new tvb is created with all the data.
If your protocol runs atop TCP, then there is built-in support for this via tcp_dissect_pdus()
, or it can be done explicitly for other scenarios. See Sect. 2.7 of README.dissector.
The full reassembly API is exposed via epan/reassemble.h but I'm not aware of any documentation for that other than in the code.