Should the "tcp_dissect_pdus()" function make it possible to handle pdu:s that stretched over more that one TCP packet? I have a capture with this type of packets, but they aren't decoded correct.
The attached patch fixes minor issue where the "dummy" data in NOP packets are being decoded. > -----Original Message----- > From: Guy Harris [mailto:[EMAIL PROTECTED] > Sent: den 27 januari 2004 05:47 > To: Ethereal development > Subject: Re: [Ethereal-dev] Patch for packet-enip.c > > > > On Jan 25, 2004, at 11:29 PM, Joakim Wiberg wrote: > > >> -----Original Message----- > >> From: Guy Harris [mailto:[EMAIL PROTECTED] > >> On Jan 22, 2004, at 11:51 PM, Joakim Wiberg wrote: > >> > >>> Attached is a small patch for packet-enip.c. It make is > possible to > >>> dissect EtherNet/IP packets that contains two or more messages > >>> encapsulated into one packet. > >> > >> Does that happen for ENIP-over-UDP, or just for ENIP-over-TCP? > > > > This is something that only can happend on TCP. > > OK, I've checked in a change to make the ENIP-over-TCP dissector use > "tcp_dissect_pdus()"; there's a preference setting to control whether > messages split across TCP segment boundaries should be reassembled > (it's on by default, and is in the "Edit->Protocols" dialog > box, under > "ENIP"; you need to turn TCP reassembly on as well - that's in > "Edit->Protocols", under TCP). Whether that preference is on or off, > it should handle multiple messages in a single TCP segment. > > _______________________________________________ > Ethereal-dev mailing list > [EMAIL PROTECTED] > http://www.ethereal.com/mailman/listinfo/ethereal-dev >
enip.diff
Description: enip.diff
_______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
