Hi,
If your dissector is on top of UDP, you can check the UDP checksum.
The CRC should be the same for identical fragments.
Regards
Philippe
Date: Wed, 25 Mar 2009 17:13:35 -0800
From: [email protected]
To: [email protected]
Subject: [Wireshark-dev] How to handle duplicate fragments for a plugin written
on top of UDP?
Hi,
We have a legacy custom plugin (written on top of UDP), which handles multicast
packets which may be fragmented, which works fine for normal scenarios.
However, the plugin fails to decode for the cases where there can be duplicate
fragments (for eg. one coming from the actual host and another one from a
firewall). The fragments are exactly the same excepting that the ethernet
source address is different.
Can someone give me pointers as to how we could handle this special case when
re-assembling the fragments? Is there a way to ignore packets coming from the
firewall? Are there any sample plugins that have handled this case, which I can
refer to?
Any suggestions would help me a lot,
Thanks,
siri
_________________________________________________________________
Téléphonez gratuitement à tous vos proches avec Windows Live Messenger !
Téléchargez-le maintenant !
http://www.windowslive.fr/messenger/1.asp
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
