TCP reassembly - How do you determine the PDU length when there is no length field?

edit

How do you determine the PDU length when there is no length field?

Perhaps you don't. For HTTP, for example, there's no length field for the HTTP header - it continues until there's a blank line - so reassembling HTTP requests and replies doesn't use tcp_dissect_pdus(). The routine that does reassembly for "request/response protocols", meaning "protocols that work somewhat like HTTP", req_resp_hdrs_do_reassembly() handles the blank-line terminator for the header and the Content-Length header for the body.

tcp_dissect_pdus() is for protocols where 1) there's a minimum length for a PDU and 2) if you have that many bytes of data from the beginning of the PDU, you can determine the length, either by extracting it from a length field, or by looking at the PDU type and determining the length based on that, or some other such mechanism.

There's currently no built-in mechanism to handle reassembly of arbitrary protocols where the length is determined by a terminator, so you'd have to implement reassembly yourself. Sadly, there's not much in the way of helper routines or documentation for how to do that. You might get some hints by looking at the way that req_resp_hdrs_do_reassembly() handles reassembling the HTTP header.

There is minimal documentation on doing things this way, but it seems that if your get_foo_pdu_length() function returns 0 then the tcp dissector will reassemble the next tcp segment.

Presumably if this is repeated until your function detects the end of text delimiter all the segments will be added to the reassembled tvb.

What I'm not sure is the value that should be returned when you detect the end of of text delimiter, is it the number of bytes required in that segment, or the number of bytes accumulated across all segments. I think it's the latter, empirical testing should show what's required.

There is some more info in docs\README.dissector section 2.7.1.

There is also an alternative method in the same file in sect. 2.7.2 which can be used

when the dissector cannot determine how many bytes it will need to read in order to determine the size of a PDU.

Please report back if you have success so that others that also have the same query can see a solution.