Wireshark - 0.99.7 Guide de l'utilisateur télécharger pdf (Page 124)

9.4. How to reassemble split packets

Some protocols have times when they have to split a large packet across multiple other packets. In

this case the dissection can't be carried out correctly until you have all the data. The first packet

doesn't have enough data, and the subsequent packets don't have the expect format. To dissect these

packets you need to wait until all the parts have arrived and then start the dissection.

9.4.1. How to reassemble split UDP packets

As an example, let's examine a protocol that is layered on top of UDP that splits up its own data

stream. If a packet is bigger than some given size, it will be split into chunks, and somehow signaled

within its protocol.

To deal with such streams, we need several things to trigger from. We need to know that this packet

is part of a multi-packet sequence. We need to know how many packets are in the sequence. We also

need to know when we have all the packets.

For this example we'll assume there is a simple in-protocol signaling mechanism to give details. A

flag byte that signals the presence of a multi-packet sequence and also the last packet, followed by

an ID of the sequence and a packet sequence number.

msg_pkt ::= SEQUENCE {

.....

flags ::= SEQUENCE {

fragment BOOLEAN,

last_fragment BOOLEAN,

.....

}

msg_id INTEGER(0..65535),

frag_id INTEGER(0..65535),

.....

}

Example 9.15. Reassembling fragments - Part 1

#include <epan/reassemble.h>

...

save_fragmented = pinfo->fragmented;

flags = tvb_get_guint8(tvb, offset); offset++;

if (flags & FL_FRAGMENT) { /* fragmented */

tvbuff_t* new_tvb = NULL;

fragment_data *frag_msg = NULL;

guint16 msg_seqid = tvb_get_ntohs(tvb, offset); offset += 2;

guint16 msg_num = tvb_get_ntohs(tvb, offset); offset += 2;

pinfo->fragmented = TRUE;

frag_msg = fragment_add_seq_check(tvb, offset, pinfo,

msg_seqid, /* ID for fragments belonging together */

msg_fragment_table, /* list of message fragments */

msg_reassembled_table, /* list of reassembled messages */

msg_num, /* fragment sequence number */

tvb_length_remaining(tvb, offset), /* fragment length - to the end */

flags & FL_FRAG_LAST); /* More fragments? */

We start by saving the fragmented state of this packet, so we can restore it later. Next comes some

protocol specific stuff, to dig the fragment data out of the stream if it's present. Having decided it is

present, we let the function fragment_add_seq_check do its work. We need to provide this with a

certain amount of data.

• The tvb buffer we are dissecting.

• The offset where the partial packet starts.

Packet dissection

110

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 146 147

Commentaires sur ces manuels

Pas de commentaire

Wireshark - 0.99.7 Guide de l'utilisateur Page 124

Commentaires sur ces manuels