I have a dissector that processes messages that are transported on TCP. In my dissector, I need to know when a tcp session has finished with a message by checking when the TCP Push flag has been set. Is there a way to get the value of that flag in my dissector? Or, is there another way to know that I have the last packet in a TCP transported message?
Why do you think PSH indicates when a session has finished with a message?
There is no notion of "messages" in TCP; TCP is a byte-stream protocol, with no message boundaries - protocols that send messages over TCP use conventions within the protocol to determine message boundaries. A common technique is to have each message start with a message length field; other techniques, for text-style protocols such as FTP, HTTP, etc. is either to use a line ending as a message end (for messages that fit in one line) or to use a blank line to separate message headers from the message body (used by, for example, HTTP - which can also use Content-Length headers as a message length field for the message body).
If your protocol does not have such a mechanism, you need to modify it to introduce such a mechanism.
The protocol is not mine, so I cannot modify it. It does not have a length at the beginning. And it is binary data that must be converted to text once I get all the packets, so I can't just look for an end of message marker. In a C# application that we have, we look for a tcp.push flag to be set to know when we received the last packet of the message. Then we can reassemble the binary data and convert it to text. This works for our C# project. The messages are using Google Protocol Buffers. Do you know if there is a way to get the length of one of those?
Asked: 2020-06-02 21:21:46 +0000
Seen: 366 times
Last updated: Jun 03 '20
