How do I dissect multiple packets?
For example, if there is information I can obtain only by using data from 2 packets (i.e packet 12 and 17), how would I dissect them?
Asked: 2017-12-05 15:10:41 +0000
Seen: 1,250 times
Last updated: Dec 05 '17
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Can you be more specific? Because I'm not sure whether I'll be answering what you actually ask.
If the PDU of the application protocol is split into several packets of a transport protocol, the dissector of the application protocol shall return 0 when invoked with incomplete data, so the dissector of the transport protocol knows it has to provide more data.
This works for TCP and probably SCTP which take care of payload completeness by means of acknowledgements and retransmissions. They collect the payload as it arrives and with each new arrival they offer it to the application layer dissector until it finally accepts it (by returning a non-zero number of processed bytes). So the dissection of the application layer is then shown in the last transport packet carrying a given PDU.
For other transport protocols like UDP where the retransmissions etc. have to be handled by the ...(more)