Hi:
I am dissecting messages, running on top of TCP. Some of them are large, and
get fragmented. Thus, I am getting a "short frame" printout next to the
message's protocol tree node. TCP handoff-s to my dissector based on a port
number (I know that on this port I will only be receiving the messages that I
am dissecting). I followed indtructions from a Jan'03 post on how to instruct
ethereal/tethereal defragment fragmented TCP messages. The problem, however,
stil reoccurs.
I think this happens because the message(s) that carry the remaining payload
are handed off to my dissector again (through the TCP dissector cause the port
matches), where I cannot do much, since the load starts from the previous
cutoff point. Is there anything I can do here to fix this? I'll greatly
appreciate your help.
Thanks,
Nik
**************************
Nik Kolev
Drexel University
Major: Computer Science
nak26@xxxxxxxxxx
**************************