Hi,
Le lundi 16 mars 2009 ￜ 13:39 +0100, Toralf Fￜrster a ￜcrit :
> Hello,
>
> for the attached dissector
> (https://www.wireshark.org/lists/wireshark-users/200902/msg00197.html) I'm
> wondering why the statistics doesn't work as expected. The attached tcp
> packet contains 2 sametime messages. The 1st message is of type "channel
You can't reuse the same sinfo structure, you have to allocate one per
PDU. ep_alloc is ok for that:
sinfo = ep_alloc(sizeof(struct SametimeTap ));
More remarks:
- Don't put all your code in one big 'if (tree) {}' block. If you don't
expect thousand of packets/second don't bother with 'if (tree)' at all.
- tcp_dissect_pdus with a minimum size of 0? it won't be able to
reassemble all cases, as a matter of I'm not sure that the
tcp_dissect_xxx really works with a size of 0.
With your protocol structure, as describe in the dissector, you can't
use tcp_dissect_pdus reliably.
It doesn't work if in the same tcp segment you have:
<heart beat><long packet>
With <hear beat> size <= 4
and <long packet> size > 8
For long packet you must use 8 as tcp_dissect_pdus parameter, and so on.
There's no easy workaround though.
Didier