Wireshark-dev: Re: [Wireshark-dev] Handling TCP packets reordering

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 04 May 2011 17:43:21 -0400
Max Dmitrichenko wrote:
2011/5/5 Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>:

I would think desegment_tcp() should be able to handle this by not calling
your dissector for an out-of-order segment: it should be able to only call
your dissector once it has a completely reassembled (desegmented) PDU.

Did you mean using of tcp_dissect_pdus(....)? As for now I use
pinfo->desegement_len
and pinfo->desegment_offset stuff. But if it is that simple, I surely redo using
this function.

Actually I meant the pinfo->desegment_len stuff (I'm not really familiar with dissect_pdus()).

I did stumble across a (apparently unrelated) problem in that it will fail if you see a gap while the subdissector is returning DESEGMENT_ONE_MORE_SEGMENT (as HTTP does until it gets all the headers): in that case TCP has to assume that the current message is not part of the existing multisegment_pdu--which unfortunately breaks things. Not sure what can be done about that...