Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-28 Thread Guy Harris
On Sep 27, 2007, at 6:43 PM, Zongjun wrote: > I am using asn1 BER encoding at the sending side. So does LDAP, and its dissector uses tcp_dissect_pdus(). The LDAP dissector is a bit complicated, as the LDAP packets use SASL and have an extra non-BER header; however, for non-SASL packets, what

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
Hello Guy, I am using asn1 BER encoding at the sending side. And It is hard to figure it out what exactly is the length byte. I have read the hexdump for some different messages, they are varying. I might be trying your suggestion when I get time. But thanks anyway. Zongjun On 9/27/07, Guy Harr

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
Hi Didier and Guys, I finally figured it out! The only change I need to do is change "offset += offset_thisRound; " to "offset = offset_thisRound". Actually I was using offset_thisRound for debugging information, to show how many bytes each time we consume. We can just remove offset_thisRound vari

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
On 9/27/07, Zongjun <[EMAIL PROTECTED]> wrote: > > Hey Didier, > > I put "offset_thisRound = > dissect_MyProtoMessage_PDU(tvb,pinfo,myproto_tree); " after if(tree){...}, > and IT WORKS! I can have multiple different PDUs in one segment! Amazing! > > The only thing is now I get much frequenter cas

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Guy Harris
On Sep 27, 2007, at 4:30 PM, Zongjun wrote: > I could have 30 different kinds of messages and I just can't know > the fix length. However, using tcp_dissect_pdus you have to give the > fix length. No. Using tcp_dissect_pdus() you have to give: 1) a fixed minimum length, which:

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
Hey Didier, I put "offset_thisRound = dissect_MyProtoMessage_PDU(tvb,pinfo,myproto_tree); " after if(tree){...}, and IT WORKS! I can have multiple different PDUs in one segment! Amazing! The only thing is now I get much frequenter cases of "malformed packet". I don't understand your point #3.

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
Ronnie, I could have 30 different kinds of messages and I just can't know the fix length. However, using tcp_dissect_pdus you have to give the fix length. Zongjun On 9/27/07, ronnie sahlberg <[EMAIL PROTECTED]> wrote: > > try using tcp_dissect_pdus() to handle the case with pdus transported > on

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread ronnie sahlberg
try using tcp_dissect_pdus() to handle the case with pdus transported ontop of tcp it will take care of this for you automatically On 9/28/07, Zongjun <[EMAIL PROTECTED]> wrote: > Hey guys, > > According to my capture, I don't have situations where ONE PDU spans over > multiple TCP segment. In st

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Didier
On Thu, 27 Sep 2007 13:13:17 -0700, Zongjun wrote > On 9/27/07, Zongjun <[EMAIL PROTECTED]> wrote:Hey Didier, > > You mean like > >     gint  offset_thisRound = 0; // of course, outside if(tree)block. > >   if (tree) { >     myproto_item = proto_tree_add_item(tree, proto_myproto, tvb, o

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
On 9/27/07, Zongjun <[EMAIL PROTECTED]> wrote: > > Hey Didier, > > You mean like gint offset_thisRound = 0; // of course, outside if(tree) block. if (tree) { > myproto_item = proto_tree_add_item(tree, proto_myproto, tvb, > offset, -1, FALSE); > myproto_tree = proto_i

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Zongjun
Hey Didier, You mean like if (tree) { gint offset_thisRound = 0 myproto_item = proto_tree_add_item(tree, proto_myproto, tvb, offset, -1, FALSE); myproto_tree = proto_item_add_subtree(myproto_item, ett_myproto); offset_thisRound = dissect_MyProtoMessage_PDU(tvb,

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Didier
Hi On Thu, 27 Sep 2007 12:02:32 -0700, Zongjun wrote > Hey guys, > > According to my capture, I don't have situations where ONE PDU spans over > multiple TCP segment. In stead, mine is the other round: Single segment > having multiple PDUs. > > But using the folling code, what I observed is wi

Re: [Wireshark-dev] Single TCP segment having multiple PDUs not working

2007-09-27 Thread Didier
Hi On Thu, 27 Sep 2007 12:02:32 -0700, Zongjun wrote > Hey guys, > > According to my capture, I don't have situations where ONE PDU spans over > multiple TCP segment. In stead, mine is the other round: Single segment > having multiple PDUs. > > But using the folling code, what I observed is wi