Understanding "TCP Segment Data"

asked 2021-02-04 14:45:06 +0000

Irwin Williams
3 ●1 ●1 ●2

I've been examining a TCP payload in wireshark. In the payload, there are several SMPP PDUs, but mixed in the packet were a few "TCP Segment Data" entries.

I looked at a few more payloads and found that the segment data entries can occur anywhere within the payload, beginning, middle or end.

First, how does wireshark know the length of the segments? I've come to see that these segment data fragments are related to re-assembled TCP segments, but I'm at a loss as to how wireshark is first able to internally ensure it's SMPP data isn't inaccurately dissected, but then, how it relates those segments to other packets. Secondly, how does it know to relate those segments to previous frames in a capture?

I tried to review the wireshark code , but it's a bit more amazing that I have powers to fully understand.

I'm still at it, but I thought I'd reach out here for help with those questions.

answered 2021-02-04 15:48:07 +0000

Jaap

13730 ●685 ●115

TLDR: it's probably easier to read this section in the Developers Guide.

First off, it's important to realise that TCP is a stream transport, so simply a continues flow of bytes. Any structure has to be defined by the protocol layer on top of TCP using this stream transport. The dissector for this protocol can make use of some simple facilities provided by the TCP dissector to handle these TCP segments. It has to provide a function which can tell the TCP dissector how many bytes it needs for a PDU, and the TCP dissector takes care of the rest. Once the TCP dissector has collected enough bytes from the incoming TCP transport it hands the requested size of bytes to this protocol dissector on top and keeps the rest (if any) for the next PDU to be handed over.

edit flag offensive delete link

Comments

There is a sample capture attached to issue 15906 which shows SMPP spanning TCP packets.

This is handled in the SMPP dissector and has a preference to enable/disable:

    prefs_register_bool_preference (smpp_module,
            "reassemble_smpp_over_tcp",
            "Reassemble SMPP over TCP messages spanning multiple TCP segments",
            "Whether the SMPP dissector should reassemble messages spanning multiple TCP segments."
            " To use this option, you must also enable "
            "\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
            &reassemble_over_tcp);

Chuckc ( 2021-02-04 16:18:47 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Understanding "TCP Segment Data"

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Understanding "TCP Segment Data" edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Understanding "TCP Segment Data"