Ethereal-dev: Re: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
Date: Mon, 13 Oct 2003 06:56:46 +1000
When DECRPC packets are reassembled, the PDU is dissected in the frame that
holds the last part of the PDU.

The PDU that starts at that offset in frame 9 is decoded in frame 11.


----- Original Message ----- 
From: Yaniv Kaul
To: ethereal-dev
Sent: Monday, October 13, 2003 12:29 AM
Subject: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment


What happens if there's more than one PDU in more than one TCP segment? It
appears that only the first PDU is dissected.

Please take a look at packet 9 of the attached capture (when enabling
desegmentation in the TCP and DCERPC protocols).
You can see that in location 0x7e8 a new DCERPC PDU begins. However, there's
no call for the DCERPC dissector to dissect it.
Could be that I don't fully understand the logic for desegmenting TCP. I'd
appreciate if someone can perhaps point to documentation on it (other than
packet-tcp.c).






_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev