How many times does tcp_dissect_pdus get called?
Raw data consists of 1 message which gets split into 2 packets (i.e. 10 and 8). Each PDU is 8 bytes. How many times does tcp_dissect_pdus get called in this case?
#define FRAME_HEADER_LEN 8 /* This method dissects fully reassembled messages */ static int dissect_foo_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_) { /* TODO: implement your dissecting code */ return tvb_captured_length(tvb); } /* determine PDU length of protocol foo */ static guint get_foo_message_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_) { return FRAME_HEADER_LEN } /* The main dissecting routine */ static int dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { tcp_dissect_pdus(tvb, pinfo, tree, TRUE, FRAME_HEADER_LEN, get_foo_message_len, dissect_foo_message, data); return tvb_captured_length(tvb); }
Wireshark - Import raw data
raw data file: 000000 0a 01 00 00 00 00 00 10 03 0a 02 00 00 00 00 00 11 03
TCP splits it into 2 packets (i.e. 10 and 8 bytes).
Debug trace is as follows:
dissect_foo() calls tcp_dissect_pdus() tcp_dissect_pdus() calls get_foo_message_len() get_foo_message_len() returns PDU size 8 There is 2 remaining bytes from 1st packet
The program executes dissect_foo_message. I would have expected dissect_foo() to call tcp_dissect_pdus() to reassemble the next packet. Building a 16 byte message.
The documentation for TCP reassembly is difficult to follow and it is not clear.