How many times does tcp_dissect_pdus get called?
Raw data consists of 1 message which gets split into 2 packets (i.e. 10 and 8). Each PDU is 8 bytes. How many times does tcp_dissect_pdus get called in this case?
#define FRAME_HEADER_LEN 8
/* This method dissects fully reassembled messages */
static int
dissect_foo_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_)
{
/* TODO: implement your dissecting code */
return tvb_captured_length(tvb);
}
/* determine PDU length of protocol foo */
static guint
get_foo_message_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
{
return FRAME_HEADER_LEN
}
/* The main dissecting routine */
static int
dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
tcp_dissect_pdus(tvb, pinfo, tree, TRUE, FRAME_HEADER_LEN,
get_foo_message_len, dissect_foo_message, data);
return tvb_captured_length(tvb);
}
Wireshark - Import raw data
raw data file: 000000 0a 01 00 00 00 00 00 10 03 0a 02 00 00 00 00 00 11 03
TCP splits it into 2 packets (i.e. 10 and 8 bytes).
Debug trace is as follows:
dissect_foo()
calls tcp_dissect_pdus()
tcp_dissect_pdus()
calls get_foo_message_len()
get_foo_message_len()
returns PDU size 8
There is 2 remaining bytes from 1st packet
The program executes dissect_foo_message. I would have expected dissect_foo() to call tcp_dissect_pdus() to reassemble the next packet. Building a 16 byte message.
The documentation for TCP reassembly is difficult to follow and it is not clear.