 | 1 | initial version |
This is known as reassembly. Data from multiple frames is accumulated for reassembly and then when all parts are present a new tvb is created with all the data.
If your protocol runs atop TCP, then there is built-in support for this via tcp_dissect_pdus(), or it can be done explicitly for other scenarios. See Sect. 2.7 of README.dissector.
The full reassembly API is exposed via epan/reassemble.h but I'm not aware of any documentation for that other than in the code.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
