diff options
author | Jaap Keuter <jaap.keuter@xs4all.nl> | 2009-04-20 05:48:04 +0000 |
---|---|---|
committer | Jaap Keuter <jaap.keuter@xs4all.nl> | 2009-04-20 05:48:04 +0000 |
commit | a6f9c55480f88a7c7f59bec1645d792a02de7ad4 (patch) | |
tree | 2d281441c18c32eeb37a41d7c564dea19efc9ea7 | |
parent | 03f240295081cfd9948708f9472337062292830c (diff) |
From Chris A:
Right now with DESEGMENT_UNTIL_FIN, the TCP dissector doesn't display the
fragment tree (the "Reassembled TCP segments" with links to the frames that
were reassembled).
Attached is one possible patch to packet-tcp.c to display the fragment tree.
Because DESEGMENT_UNTIL_FIN dissects the FIN packet as the high-level PDU, the
fragment tree also contains the FIN packet. It has 0 bytes of PDU data. Ugly but logical..
svn path=/trunk/; revision=28090
-rw-r--r-- | epan/dissectors/packet-tcp.c | 45 |
1 files changed, 26 insertions, 19 deletions
diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c index a4ad27684a..f56bcbce68 100644 --- a/epan/dissectors/packet-tcp.c +++ b/epan/dissectors/packet-tcp.c @@ -1392,6 +1392,29 @@ tcp_print_sequence_number_analysis(packet_info *pinfo, tvbuff_t *tvb, proto_tree } +static void +print_tcp_fragment_tree(fragment_data *ipfd_head, proto_tree *tree, proto_tree *tcp_tree, packet_info *pinfo, tvbuff_t *next_tvb) +{ + proto_item *tcp_tree_item, *frag_tree_item; + + /* + * The subdissector thought it was completely + * desegmented (although the stuff at the + * end may, in turn, require desegmentation), + * so we show a tree with all segments. + */ + show_fragment_tree(ipfd_head, &tcp_segment_items, + tree, pinfo, next_tvb, &frag_tree_item); + /* + * The toplevel fragment subtree is now + * behind all desegmented data; move it + * right behind the TCP tree. + */ + tcp_tree_item = proto_tree_get_parent(tcp_tree); + if(frag_tree_item && tcp_tree_item) { + proto_tree_move_item(tree, tcp_tree_item, frag_tree_item); + } +} /* ************************************************************************** * End of tcp sequence number analysis @@ -1477,8 +1500,6 @@ desegment_tcp(tvbuff_t *tvb, packet_info *pinfo, int offset, guint32 deseg_seq; gint nbytes; proto_item *item; - proto_item *frag_tree_item; - proto_item *tcp_tree_item; struct tcp_multisegment_pdu *msp; again: @@ -1688,23 +1709,7 @@ again: "TCP segment data (%u byte%s)", nbytes, plurality(nbytes, "", "s")); - /* - * The subdissector thought it was completely - * desegmented (although the stuff at the - * end may, in turn, require desegmentation), - * so we show a tree with all segments. - */ - show_fragment_tree(ipfd_head, &tcp_segment_items, - tree, pinfo, next_tvb, &frag_tree_item); - /* - * The toplevel fragment subtree is now - * behind all desegmented data; move it - * right behind the TCP tree. - */ - tcp_tree_item = proto_tree_get_parent(tcp_tree); - if(frag_tree_item && tcp_tree_item) { - proto_tree_move_item(tree, tcp_tree_item, frag_tree_item); - } + print_tcp_fragment_tree(ipfd_head, tree, tcp_tree, pinfo, next_tvb); /* Did the subdissector ask us to desegment some more data? This means that the data @@ -3543,6 +3548,8 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) process_tcp_payload(next_tvb, 0, pinfo, tree, tcp_tree, tcph->th_sport, tcph->th_dport, tcph->th_seq, nxtseq, FALSE, tcpd); + print_tcp_fragment_tree(ipfd_head, tree, tcp_tree, pinfo, next_tvb); + return; } } |