Ask Your Question

How do I dissect multiple packets?

asked 2017-12-05 15:10:41 +0000

mest112 gravatar image

For example, if there is information I can obtain only by using data from 2 packets (i.e packet 12 and 17), how would I dissect them?

edit retag flag offensive close merge delete


Can you be more specific? Because I'm not sure whether I'll be answering what you actually ask.

If the PDU of the application protocol is split into several packets of a transport protocol, the dissector of the application protocol shall return 0 when invoked with incomplete data, so the dissector of the transport protocol knows it has to provide more data.

This works for TCP and probably SCTP which take care of payload completeness by means of acknowledgements and retransmissions. They collect the payload as it arrives and with each new arrival they offer it to the application layer dissector until it finally accepts it (by returning a non-zero number of processed bytes). So the dissection of the application layer is then shown in the last transport packet carrying a given PDU.

For other transport protocols like UDP where the retransmissions etc. have to be handled by the ...(more)

sindy gravatar imagesindy ( 2017-12-05 16:09:34 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2017-12-05 16:15:26 +0000

grahamb gravatar image

This is known as reassembly. Look at README.dissector sect. 2.7.

edit flag offensive delete link more


2.7 seems to be only for TCP, is there instructions for reassembly for UDP?

mest112 gravatar imagemest112 ( 2017-12-05 16:46:09 +0000 )edit

Yep, 2.8, udp_dissect_pdus but that function only handles multiple PDU's in a single packet. If spread across multiple packets then you'll need to use the fragmentation API as detailed in the Developers Guide Sect 9.4.

grahamb gravatar imagegrahamb ( 2017-12-06 11:02:58 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-12-05 15:10:41 +0000

Seen: 1,308 times

Last updated: Dec 05 '17