Ask Your Question

Is it possible to use reassembly on non-split packets?

asked 2017-12-14 16:06:57 +0000

mest112 gravatar image

updated 2017-12-14 16:14:04 +0000

I need to dissect multiple packets, but they are not necessarily related (ie. non-split packets).

edit retag flag offensive close merge delete


Can you expand your question, over what protocol are these packets running, are they sequential, fragmented, anything else you can think of to explain the issue.

grahamb gravatar imagegrahamb ( 2017-12-14 16:38:59 +0000 )edit

These packets are running over UDP. I'm still fairly new to wireshark, so I'm still not familiar with some terms, like "sequential" or "fragmented". When I was reading the developer's guide section 9.4, I found that if a packet is too large, it can be split, and the data is spread between multiple packets. To do my dissection, I need to reassemble these split packets. What I want to know, is that is it possible to use the reassembly API to assemble packets that aren't split?

mest112 gravatar imagemest112 ( 2017-12-14 16:44:33 +0000 )edit

I'm missing something here, if you have the complete packet because it isn't split, why do you need to reassemble?

Note that this is quite an advanced topic for dissectors and there isn't much documentation apart from in the reassembly code itself, and the existing dissectors that use it.

grahamb gravatar imagegrahamb ( 2017-12-14 18:37:05 +0000 )edit

It's for a project, if it isn't possible to apply reassembly to packets that aren't split, then is there another way to dissect multiple packets in a single dissector?

mest112 gravatar imagemest112 ( 2017-12-14 19:37:47 +0000 )edit

So do you have multiple packets for your protocol inside a single link-layer frame, a single packet for your protocol that is made up from multiple link-layer frames, or both?

Guy Harris gravatar imageGuy Harris ( 2017-12-15 05:22:40 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2017-12-14 21:51:06 +0000

JeffMorriss gravatar image

Are you saying that you've got 2 fragments of your upper-layer protocol in a single IP packet/Ethernet frame and you want to be able to reassemble them?

I believe that, yes, this will work. I'm pretty sure I've seen this happen with SCTP. It was bizarre (though apparently legal--IIRC) that SCTP could fragment and put the 2 fragments in a single IP packet.

How this would work I'm not really sure; the SCTP dissector might serve as a useful reference.

edit flag offensive delete link more


No, I'm not talking about multiple fragments in a single packet, I'm talking about entirely separate packets.

mest112 gravatar imagemest112 ( 2017-12-15 14:31:38 +0000 )edit

By "multiple fragments in a single packet" do you mean that, in a single link-layer packet, you have multiple sub-packets that are not, by themselves, complete packets, and must then be reassembled into a complete packet?

Or do you mean that, in a single link-layer packet, you have multiple complete packets?

Guy Harris gravatar imageGuy Harris ( 2017-12-15 18:20:15 +0000 )edit

Multiple complete packets, which I don't know how to dissect in a single dissector.

mest112 gravatar imagemest112 ( 2017-12-15 18:36:25 +0000 )edit

You don't have to do anything special. Your dissector process the first PDU, returns how many bytes it read from the tvb, and then your dissector will be called again for the subsequent PDUs.

grahamb gravatar imagegrahamb ( 2017-12-15 18:49:39 +0000 )edit

Multiple complete packets, which I don't know how to dissect in a single dissector.

So are you saying, for example, that, in your other question, frames 39 through 44 each have multiple MASP packets in them, and that all of each of those packets is contained within one frame?

Guy Harris gravatar imageGuy Harris ( 2017-12-15 19:04:44 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2017-12-14 16:06:57 +0000

Seen: 409 times

Last updated: Dec 14 '17