How do I dissect multiple packets?
For example, if there is information I can obtain only by using data from 2 packets (i.e packet 12 and 17), how would I dissect them?
For example, if there is information I can obtain only by using data from 2 packets (i.e packet 12 and 17), how would I dissect them?
This is known as reassembly. Look at README.dissector sect. 2.7.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2017-12-05 15:10:41 +0000
Seen: 1,417 times
Last updated: Dec 05 '17
How do I use the fragment_add_seq_check function in UDP packet reassembly?
Is it possible to use reassembly on non-split packets?
How do I dissect packets if the dissection depends on information from earlier packets?
Little Endian for "Proto_Tree_Add_Bits" Function
Capture incoming packets from remote web server
How do I get and display packet data information at a specific byte from the first byte?
How do I add "child item" to an item in the subtree?
How do I get relative ack number greater than sequence number?
Can you be more specific? Because I'm not sure whether I'll be answering what you actually ask.
If the PDU of the application protocol is split into several packets of a transport protocol, the dissector of the application protocol shall return 0 when invoked with incomplete data, so the dissector of the transport protocol knows it has to provide more data.
This works for TCP and probably SCTP which take care of payload completeness by means of acknowledgements and retransmissions. They collect the payload as it arrives and with each new arrival they offer it to the application layer dissector until it finally accepts it (by returning a non-zero number of processed bytes). So the dissection of the application layer is then shown in the last transport packet carrying a given PDU.
For other transport protocols like UDP where the retransmissions etc. have to be handled by the ...(more)