Maybe I don't understand tcp_dissect_pdus.
If a user message overruns an ethernet frame, tcp_dissect_pdus is
supposed to allocate enough space to hold the entire user message, and
only call the user's dissector when the entire message has been
received... right?
So if we get a frame with user packet lengths
1056 --> parsed here, since frame has 1448 TCP bytes (right?)
112 --> "", total now 1168
1868 --> Parsed later. total size would be 3036
when wireshark gets third packet, it should allocate a buffer big enough
to handle it (right?), then wait for enough data to arrive before doing
so, right?
In fact, 2 more frames would be requires since in first frame only 280
of 1868 bytes are parsed, leaving 1608 bytes, requiring two more frames?
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
