Ambarisha B skrev 2013-04-19 23:01:
Not necessarily if we can hide the fact in the tvb or reassembly
functions. I think the first step is to find out
how feasible this idea is and an implementation strategy. gziped
files, encrypted files etc may prove the idea not valid.
An alternative is store reassembled packet in file in some way. In
pcap-ng it could be a block option or a new block type pitfalls may
be missdisection change of preferences lost packets etc one would
probably need to be able to reread the original file in some way.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
|