Ethereal-dev: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Yaniv Kaul <ykaul@xxxxxxxxxxxx>
Date: Sun, 12 Oct 2003 16:29:49 +0200
What happens if there's more than one PDU in more than one TCP segment? It appears that only the first PDU is dissected.

Please take a look at packet 9 of the attached capture (when enabling desegmentation in the TCP and DCERPC protocols).
You can see that in location 0x7e8 a new DCERPC PDU begins. However, there's no call for the DCERPC dissector to dissect it.
Could be that I don't fully understand the logic for desegmenting TCP. I'd appreciate if someone can perhaps point to documentation on it (other than packet-tcp.c).

Attachment: dcerpc-seg.cap
Description: Binary data