Ask Your Question

Revision history [back]

This is known as reassembly. Data from multiple frames is accumulated for reassembly and then when all parts are present a new tvb is created with all the data.

If your protocol runs atop TCP, then there is built-in support for this via tcp_dissect_pdus(), or it can be done explicitly for other scenarios. See Sect. 2.7 of README.dissector.

The full reassembly API is exposed via epan/reassemble.h but I'm not aware of any documentation for that other than in the code.