dissector access fragment bytes

asked 2020-05-03 14:26:33 +0000

yaroni gravatar image

I have custom code in epan/dissectors/packet-gsm_sms.c to mask sms text in function dis_field_ud
I call "tshark -ta -n -2 -r input_pcap.pcap -w output_pcap.pcap" and save new pcap with the masked text.
It work ok, but when ip or sctp is fragmented it doesn't work.
Is there a way to reset the bytes of the orginal fragments?

The code to clean the sms text is before the following line
It set the tvb bytes to 0 at offset, length

subtree = proto_tree_add_subtree(tree, tvb,
                        offset, length,
                        ett_ud, NULL, "TP-User-Data");
edit retag flag offensive close merge delete