User guide

• The provided packet info.
• The sequence number of the fragment stream. There may be several streams of fragments in
flight, and this is used to key the relevant one to be used for reassembly.
• The msg_fragment_table and the msg_reassembled_table are variables we need to declare. We'll
consider these in detail later.
• msg_num is the packet number within the sequence.
• The length here is specified as the rest of the tvb as we want the rest of the packet data.
• Finally a parameter that signals if this is the last fragment or not. This might be a flag as in this
case, or there may be a counter in the protocol.
Example 9.16. Reassembling fragments part 2
new_tvb = process_reassembled_data(tvb, offset, pinfo,
"Reassembled Message", frag_msg, &msg_frag_items,
NULL, msg_tree);
if (frag_msg) { /* Reassembled */
if (check_col(pinfo->cinfo, COL_INFO))
col_append_str(pinfo->cinfo, COL_INFO,
" (Message Reassembled)");
} else { /* Not last packet of reassembled Short Message */
if (check_col(pinfo->cinfo, COL_INFO))
col_append_fstr(pinfo->cinfo, COL_INFO,
" (Message fragment %u)", msg_num);
}
if (new_tvb) { /* take it all */
next_tvb = new_tvb;
} else { /* make a new subset */
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
}
}
else { /* Not fragmented */
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
}
.....
pinfo->fragmented = save_fragmented;
Having passed the fragment data to the reassembly handler, we can now check if we have the whole
message. If there is enough information, this routine will return the newly reassembled data buffer.
After that, we add a couple of informative messages to the display to show that this is part of a se-
quence. Then a bit of manipulation of the buffers and the dissection can proceed. Normally you will
probably not bother dissecting further unless the fragments have been reassembled as there won't be
much to find. Sometimes the first packet in the sequence can be partially decoded though if you
wish.
Now the mysterious data we passed into the fragment_add_seq_check.
Example 9.17. Reassembling fragments - Initialisation
static GHashTable *msg_fragment_table = NULL;
static GHashTable *msg_reassembled_table = NULL;
static void
msg_init_protocol(void)
Packet dissection
111