From aa5d9d78ddcb4b7066ab03afa4277fab0bf0f468 Mon Sep 17 00:00:00 2001 From: Jeff Morriss Date: Fri, 7 Sep 2012 02:09:59 +0000 Subject: From Robert Bullen via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 : The reassembled fragments tree in the Packet Details view is awesome, but it lacks one thing: a field that exposes the reassembled data. tcp.data already exists for exposing a single TCP segment's payload as a byte array. It would be handy to have something similar for a single application layer PDU when TCP segment reassembly is involved. I propose tcp.reassembled.data, named and placed after the already existing field tcp.reassembled.length. My primary use case for this feature is outputting tcp.reassembled.data with tshark for further processing with a script. The attached patch implements this very feature. Because the reassembled fragment tree code is general purpose, i.e. not specific to just TCP, any dissector that relies upon it can add a similar field very cheaply. In that vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which expose reassembled fragment data as a single byte stream for IPv4 and IPv6, respectively. All other protocols that use the reassembly code have been left alone, other than inserting NULL into their initializer lists for the newly introduced struct field reassemble.h:fragment_items.hf_reassembled_data. svn path=/trunk/; revision=44802 --- epan/dissectors/packet-rpc.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'epan/dissectors/packet-rpc.c') diff --git a/epan/dissectors/packet-rpc.c b/epan/dissectors/packet-rpc.c index cd346be70f..fa114556b6 100644 --- a/epan/dissectors/packet-rpc.c +++ b/epan/dissectors/packet-rpc.c @@ -289,6 +289,8 @@ static const fragment_items rpc_frag_items = { &hf_rpc_fragment_count, NULL, &hf_rpc_reassembled_length, + /* Reassembled data field */ + NULL, "fragments" }; -- cgit v1.2.3