Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-07 Thread Jakub Zawadzki
On Wed, May 04, 2011 at 10:27:32PM +0200, Sake Blok wrote: > On 4 mei 2011, at 22:11, Jeff Morriss wrote: > > I would think desegment_tcp() should be able to handle this by not calling > > your dissector for an out-of-order segment: > it should be able to only call your dissector once it has a co

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Max Dmitrichenko
2011/5/5 Jeff Morriss : > > I did stumble across a (apparently unrelated) problem in that it will fail > if you see a gap while the subdissector is returning > DESEGMENT_ONE_MORE_SEGMENT (as HTTP does until it gets all the headers): in > that case TCP has to assume that the current message is not p

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Sake Blok
On 4 mei 2011, at 23:33, Jeff Morriss wrote: > Sake Blok wrote: >> On 4 mei 2011, at 22:48, Jeff Morriss wrote: >>> Sake Blok wrote: One case that can cause a problem is when the first segment of a PDU is received out-of-order. Or did your recent work also handle this exception, J

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Jeff Morriss
Max Dmitrichenko wrote: 2011/5/5 Jeff Morriss : I would think desegment_tcp() should be able to handle this by not calling your dissector for an out-of-order segment: it should be able to only call your dissector once it has a completely reassembled (desegmented) PDU. Did you mean using of tc

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Jeff Morriss
Sake Blok wrote: On 4 mei 2011, at 22:48, Jeff Morriss wrote: Sake Blok wrote: On 4 mei 2011, at 22:11, Jeff Morriss wrote: Max Dmitrichenko wrote: Hi! I'm continue to write dissector for an encrypted protocol. Everything works fine until I receive an out-of-order TCP segment, i.e. previous w

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Max Dmitrichenko
2011/5/5 Jeff Morriss : > I would think desegment_tcp() should be able to handle this by not calling > your dissector for an out-of-order segment: it should be able to only call > your dissector once it has a completely reassembled (desegmented) PDU. Did you mean using of tcp_dissect_pdus()?

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Sake Blok
On 4 mei 2011, at 22:48, Jeff Morriss wrote: > Sake Blok wrote: >> On 4 mei 2011, at 22:11, Jeff Morriss wrote: >>> Max Dmitrichenko wrote: Hi! I'm continue to write dissector for an encrypted protocol. Everything works fine until I receive an out-of-order TCP segment, i.e. previous

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Max Dmitrichenko
2011/5/5 Jeff Morriss : > Sake Blok wrote: >> >> On 4 mei 2011, at 22:11, Jeff Morriss wrote: >> >>> >>> I would think desegment_tcp() should be able to handle this by not >>> calling your dissector for an out-of-order segment: it should be able to >>> only call your dissector once it has a complet

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Jeff Morriss
Sake Blok wrote: On 4 mei 2011, at 22:11, Jeff Morriss wrote: Max Dmitrichenko wrote: Hi! I'm continue to write dissector for an encrypted protocol. Everything works fine until I receive an out-of-order TCP segment, i.e. previous was lost. Since I'm trying to decrypt it, I fail with it and bre

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Sake Blok
On 4 mei 2011, at 22:11, Jeff Morriss wrote: > Max Dmitrichenko wrote: >> Hi! >> I'm continue to write dissector for an encrypted protocol. Everything >> works fine until I receive an out-of-order TCP segment, i.e. previous >> was lost. >> Since I'm trying to decrypt it, I fail with it and break

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Jeff Morriss
Max Dmitrichenko wrote: Hi! I'm continue to write dissector for an encrypted protocol. Everything works fine until I receive an out-of-order TCP segment, i.e. previous was lost. Since I'm trying to decrypt it, I fail with it and break the whole decryption context. Is there any way to: 1) Detect

Re: [Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Mikko Saarnivala
Oon perjantaina toimistolla. Mikko Max Dmitrichenko wrote: >Hi! > >I'm continue to write dissector for an encrypted protocol. Everything >works fine until I receive an out-of-order TCP segment, i.e. previous >was lost. >Since I'm trying to decrypt it, I fail with it and break the whole >decrypt

[Wireshark-dev] Handling TCP packets reordering

2011-05-04 Thread Max Dmitrichenko
Hi! I'm continue to write dissector for an encrypted protocol. Everything works fine until I receive an out-of-order TCP segment, i.e. previous was lost. Since I'm trying to decrypt it, I fail with it and break the whole decryption context. Is there any way to: 1) Detect that this packet is out of