Hi, >From looking a the source it seems TPKT should already do TCP reassembly. Make sure both these options are enabled: Edit/Preferences/Protocols/TPKT/Desegment all TPKT ... which should be enabled by default Edit/Preferences/Protocols/TCP/Allow subdissector to desegment TCP streams which should be disabled by default
With both these options enabled, ethereal will eat quite a lot more memory but will desegment TPKT (and by default, all other TCP services capable of desegmentation as well) --- In general: it should be fairly easy to add tcp reassembly to <protocol-x> and would probably require minimal code. example: see packet-diameter.c search for "desegment" see dissect_diameter_tcp for a nice loop you can steal/borrow that handles both multiple PDUs in one segment as well as PDUs spanning multiple segments. you also need to define an option to enable/disable the feature, see packet-diameter.c for that as well. ----- Original Message ----- From: "Georg Hellack" Sent: Tuesday, July 02, 2002 10:25 PM Subject: [Ethereal-dev] Packet re-assembly for RFC1006; OSI upper layers ? > Hello, > > first of all congratulations to the excellent work on Ethereal. I just > tested it on some OSI via TCP communication using RFC1006. > Apparently the TPKT (RFC1006) module does not do TCP packet re-assembly, but > decodes each TCP frame starting with the RFC1006 header. > Is there anyone already working on this issue ? > If not, are there examples from other protocols on how to do TCP re-assembly > in Ethereal in general ? > I am also interested in OSI upper layers (Session, Presentation and ACSE). > Anyone working on that ? Or can point out some sources of information on > this beside the standard documents ? > > Best regards, > > Georg Hellack
