Andrew Schweitzer
Wed, 25 Oct 2006 18:03:00 -0700
Maybe I don't understand tcp_dissect_pdus.
If a user message overruns an ethernet frame, tcp_dissect_pdus is
supposed to allocate enough space to hold the entire user message, and
only call the user's dissector when the entire message has been
received... right?
So if we get a frame with user packet lengths
1056 --> parsed here, since frame has 1448 TCP bytes (right?)
112 --> "", total now 1168
1868 --> Parsed later. total size would be 3036
when wireshark gets third packet, it should allocate a buffer big enough to handle it (right?), then wait for enough data to arrive before doing so, right? In fact, 2 more frames would be requires since in first frame only 280 of 1868 bytes are parsed, leaving 1608 bytes, requiring two more frames? _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev