What happened to reassemble_tcp?

asked 2018-05-25 17:02:26 +0000

Matt Davis
9 ●1 ●6 ●7

I pulled the Wireshark code several years ago (v1.8.6) to use its TCP reassembly logic to build a custom TCP reassembler for a project I work on. I'm needing that same logic today, and I'd like to use the latest version of the code (v2.6.1) as a go-by, but I cannot find the reassemble_tcp function in follow.c.

Can anyone point me to where/how the TCP reassembly is accomplished in the Wireshark code base today?

answered 2018-05-25 19:58:31 +0000

Guy Harris
19890 ●3 ●634 ●207

There's "TCP reassembly" in the sense of the mechanism used when dissecting packets and there's "TCP reassembly" in the sense of the mechanism used by "Follow TCP Stream".

You're referring to the latter of those.

This is done differently in current versions of Wireshark. "Follow TCP Stream" has been generalized to "Follow XXX Stream"; the various "XXX" dissectors register their own code to do stream-following, using the register_follow_stream() routine. For example, for XXX = TCP, that's done in a call at the end of proto_register_tcp() in epan/dissectors/packet-tcp.c.

edit flag offensive delete link

Comments

Guy, thank you. I was hoping you'd chime in on this. That definitely helps.

Matt Davis ( 2018-05-29 14:28:31 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

What happened to reassemble_tcp?

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

What happened to reassemble_tcp? edit

1 Answer

Comments