Wireshark-bugs: [Wireshark-bugs] [Bug 8570] LDAP dissector doesn't account for reuse of MessageI

Date: Tue, 09 Apr 2013 03:30:52 +0000

Comment # 1 on bug 8570 from
There are probably several places where an ID that's reused is used (possibly
in conjunction with flow/conversation endpoint identifiers) as a lookup key;
this happens in both the reassembly code and in the various bits of
request/response matching code in various dissectors.

In most if not all of those cases the matching also needs to take frame numbers
into account, so that different packets with the same ID aren't considered the
same packet.

With reassembly, that can be done in one place; with request/response matching,
that'll require changing each of the bits of request/response matching code
separately.

We should probably consider having common code for request/response matching,
so that multiple dissectors can use it.  It might want to do endpoint matching
the same way the reassembly code was recently changed to do it, so that
different protocols can use different endpoint identifiers.

As I think LDAP might be the first protocol where this issue was brought up for
request/response matching, perhaps it should be the first place to use common
code of that sort, with the common code made to do matching that takes frame
numbers into account.


You are receiving this mail because:
  • You are watching all bug changes.