Ask Your Question

Is it possible to put data from several frames in one tvbuff_t buffer?

asked 2021-03-23 07:24:46 +0000

Robin26689 gravatar image

Hi together,

is it possible to write data from several frames in the same tvbuff_t buffer? If not is it possible to use proto_tree_add_item() with a different buffer as the tvb? I need to collect data before i can decide how to dissect it, maybe there are better options than my idea? I'm working on a plugin c dissector.

Thanks for help

best regards


edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-03-23 09:07:19 +0000

grahamb gravatar image

This is known as reassembly. Data from multiple frames is accumulated for reassembly and then when all parts are present a new tvb is created with all the data.

If your protocol runs atop TCP, then there is built-in support for this via tcp_dissect_pdus(), or it can be done explicitly for other scenarios. See Sect. 2.7 of README.dissector.

The full reassembly API is exposed via epan/reassemble.h but I'm not aware of any documentation for that other than in the code.

edit flag offensive delete link more


Unfortunatley it doesn't run atop of tcp. I think i already looked at the reassamble.h file but i will look at it again because i got a bit more expirience than last time. Hope i will figure out that it will work in a proper way. Thanks!

Robin26689 gravatar imageRobin26689 ( 2021-03-23 09:16:05 +0000 )edit

You can also look at other dissectors using it for some guidance, but then you have to understand those protocols.

grahamb gravatar imagegrahamb ( 2021-03-23 09:19:09 +0000 )edit

yes that would work. I will try. Otherwise i have to live with the fact, that the dissection just works on the first run if i leave it like it is now. Should be enough for my thesis.

Robin26689 gravatar imageRobin26689 ( 2021-03-23 09:22:09 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-03-23 07:24:46 +0000

Seen: 149 times

Last updated: Mar 23 '21