Hi,
I hate fragmented packets.
Attached is a patch for ethereal, please test it and check it in.
I have tested it for several mediumsized captures and it seems to work quite
well.
The patch contains the following features:
* (major part) changes to packet-tcp.c to allow it to desegment
segments into larger blocks if a dissector called from packet-tcp.c
requests it. This option must be enabled for any of the other options to
work.
Desegmentation is different from reassembly of IP packets.
* (very small) changes to packet-rpc.c to allow RPCoverTCP desegmentation.
* (very small) changes to packet-nbns.c to allow NBSSoverTCP desegmentation.
The default setting for these three options is OFF, so by default ethereal
will behave as it always has.
(for desegmentation of NBSS to be really useful we musrt wait for
packet-smb.c to be tvbuffified so that SMBtransact can get reassembled.)
Please look at the changes to packet-rpc.c : It is extremely easy/trivial to
apply TCPdesegmentation to other protocol dissectors.
The file also contain a text file explaining the three new options.
Have fun, play with it, enjoy and please check in.
best regards
ronnie sahlberg
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
Attachment:
tcp.tgz
Description: application/gzip-compressed