Is it possible to put data from several frames in one tvbuff_t buffer?

asked 2021-03-23 07:24:46 +0000

Robin26689
13 ●1 ●4 ●6

Hi together,

is it possible to write data from several frames in the same tvbuff_t buffer? If not is it possible to use proto_tree_add_item() with a different buffer as the tvb? I need to collect data before i can decide how to dissect it, maybe there are better options than my idea? I'm working on a plugin c dissector.

Thanks for help

best regards

Robin

answered 2021-03-23 09:07:19 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

This is known as reassembly. Data from multiple frames is accumulated for reassembly and then when all parts are present a new tvb is created with all the data.

If your protocol runs atop TCP, then there is built-in support for this via tcp_dissect_pdus(), or it can be done explicitly for other scenarios. See Sect. 2.7 of README.dissector.

The full reassembly API is exposed via epan/reassemble.h but I'm not aware of any documentation for that other than in the code.

edit flag offensive delete link

Comments

Unfortunatley it doesn't run atop of tcp. I think i already looked at the reassamble.h file but i will look at it again because i got a bit more expirience than last time. Hope i will figure out that it will work in a proper way. Thanks!

Robin26689 ( 2021-03-23 09:16:05 +0000 )edit

You can also look at other dissectors using it for some guidance, but then you have to understand those protocols.

grahamb ( 2021-03-23 09:19:09 +0000 )edit

yes that would work. I will try. Otherwise i have to live with the fact, that the dissection just works on the first run if i leave it like it is now. Should be enough for my thesis.

Robin26689 ( 2021-03-23 09:22:09 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Is it possible to put data from several frames in one tvbuff_t buffer?

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Is it possible to put data from several frames in one tvbuff_t buffer? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Is it possible to put data from several frames in one tvbuff_t buffer?