Ethereal-users: Re: [Ethereal-users] How to modify the raw hex data display in ethereal?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 06 Dec 2005 01:08:45 -0800
Jayanna, Jay wrote:


I am working on reassembling fragmented packets over UDP
We already reassemble fragmented IP datagrams, so you're not referring to UDP datagrams that are themselves fragmented.
Are you referring to some protocol that runs over UDP, and that sends a packet as one or more fragments, with each fragment being a UDP datagram? 


on a linux box.


The OS doesn't matter.
I have reassembled the raw hex data. I am able to decode the reassembled data in the 2^nd window pane that has the all the network layer info correctly. But I am not able to modify the raw hex data that I see in the 3^rd pane. It just shows the data part of the last fragment. 

You have to register the reassembled data as a "data source".
"process_reassembled_data()" will do a lot of the work for you, including that. Look at some of the dissectors that call it.