Kristof Provost wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> I suspect it will be easier if you use the tcp_dissect_pdus() function.
> If you can determine the message length without reading the entire
> message (you can) that's the recommended approach.
I can determine the *message* length only when i have already
the complete header.
Immagine if I capture a multiple message packet and immagine
it is fragmented in a point after the end of the ultimate
complete message and before the mesageLenght field of the
broken message:
|<-----------------myMsg------------------->|
...|---------+------- -+----+------------+--------+--||---+
...|tcpHeader|5555555 5|0000|mesageLenght|messgeId|details|
...|---------+------- -+----+------------+--------+--||---+
^Fragmentation
I can't understand how much byte I have to take to complete the PDU.
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
