The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
Also (for a few files):
- create/use some extended value strings;
- remove unneeded #include files;
- remove unneeded variable initialization;
- re-order fcns slightly so prefs_reg_handoff...() at end, etc
svn path=/trunk/; revision=44438
Tried to provide consistency with GSM dissector (protocol) names, even if the filenames now don't match the dissector name.
svn path=/trunk/; revision=44162
Stop applying a specific treatment when receiving a SMS-DELIVER packet with an unknown direction (no such treatment is done for SMS-SUBMIT).
Store SMS fragment length in hash table to avoid mangling the output when displaying the reassembled SMS.
svn path=/trunk/; revision=42064
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
- Take out the if(tree) because for reassembly to work we need to do the
reassembly on the first pass.
- Remove the (confusing) "try_dissect_message_fragment" preference (which
caused us to dissect the message fragments) and replace it with a "reassembly"
preference. Dissect the message fragments regardless of whether reassembly is
enabled or not (it's just SMS). This solves the user confusion reported in
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4232 .
- Add the text of the SMS using proto_tree_add_string*() so that we an filter on
the text.
svn path=/trunk/; revision=32812
Anders Broman