check out packet-ip and/or packet-tcp.
There is a call to something like add_fragment.
It's return type is a tvbuff to the reconstructed payload.
There is another call along the lines of tvb_child that hooks can add an
extra "binary data" section for the reconstructed payload.
Thin it's just calling the dissector on the reconstructed payload.
My original e-mail was more in depth, but my computer blue screened :(
... An annoying problem lately. Hopefully the names I quoted aren't too
far off and they can be found easily in real code... There's a lot of
extra work revolving around checking various error scenarios...
Maybe it would be cool to have a generic "check for and print errors to
this proto_tree item" function to verbosely print all errors and even
allow a generic type of filtering (even if it isn't specifically
custom_protocol_name.defragment.overlapping_fragments and is just
defragment.overlapping_fragments...)
William Mulvihill wrote:
>
> Hi again,
> What would be the best way in the Ethereal API to assemble a multipart
> packet? That is, I've got a UDP protocol, in the first packet, you find
> out the packet type, data size and Message number, but the entire data
> may not be contained in the first packet. It may be strewn across more
> than 32 packets. These packets have identifiers saying "I'm packet #4
> of 6 in Message #32" and then just contain data.
>
> So what I need to know if how to reassemble the whole "Message" to be
> able to parse the entire data set at once (if of course every packet in
> the message arrives safely, sometimes it does not)? It wouldn't matter
> if I added the entire parsing of the packet to the first or last packet
> tree. Either would be fine.
>
> I looked at the README.developer and read about conversations, but I
> don't think that's what I'm after. Is p_add_proto_data what I should be
> looking at? But I could have multiple "Messages" interlaced...
>
> Thanks in advance for your advice.
>
> -Will Mulvihill
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev