Wireshark-dev: Re: [Wireshark-dev] N in 1 packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 10 Dec 2011 22:23:17 -0800
On Dec 9, 2011, at 3:11 PM, Akos Vandra wrote:

> For my thesis project I am trying to get a new type of data source,
> ARM TPIU trace messages to work with wireshark.
> 
> I am starting of getting the hang of how libpcap works, however a
> strange problem arose, that I don't know how would be best handled.
> 
> "On the wire", there are fix, 16-byte frames. However these frames
> don't contain any useful data, they only act as a container for
> smaller data packets, which are packed, and sent together.

	...

> Also, sometimes these
> "sub-packets" are not within a single 16-byte frame, sometimes they
> are split, if the remaining space in the 16-byte frame is too small
> for the packet to fit.

So if those 16-byte frames have no internal structure (for example, you don't have a time stamp in each frame), but are just like, for example, the line boundaries in a hex dump, my inclination would be to have the pcap module break the byte stream into packets, even if that means that it needs to buffer a partial packet in a case where a 16-byte frame contains the beginning of a packet but not the end of the packet.