Home page logo

wireshark logo Wireshark mailing list archives

Re: Copying TVBs for Reassembly [Was: Filebacked-tvbuffs : GSoC'13]
From: Guy Harris <guy () alum mit edu>
Date: Thu, 18 Apr 2013 15:22:07 -0700

On Apr 18, 2013, at 1:40 PM, Evan Huus <eapache () gmail com> wrote:

The reassembly code could then add meta-data to this when
reassembling, and the tvb could lazily refetch the underlying tvbs
using the existing wiretap interface?

Lazily *regenerate* the underlying tvbs.

The "bottom-level" tvbs would be regenerated by reading packet data from the file.

However, there might be "intermediate-level" tvbs that do *not* contain data directly fetched from a file; instead, the 
data might have been decompressed, or decrypted, or de-encoded from base-64, or otherwise processed.  Consider a packet 
reassembled from 3 lower-leel chunks, the first of which came from a base-64 decoding of still lower-level data 
reassembled from 5 even lower-level decrypted packets....

Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]