On Tue, Sep 17, 2002 at 11:23:27PM +0000, didier wrote: > If the packet is malformed bail out early (before allocating 32000 > subtrees for example).
Checked in, along with a couple of fixes to other problems I found when looking at your change. > BTW How do I do if I want to reset a conversation eg: > in the same capture: > A) > ip1:pt1 --> ip2:pt2 > ip1:pt1 --> ip2:pt2 <RST> > some stuff > B) > ip1:pt1 --> ip2:pt2 <SYN> > .... > now A and B are in the same conversation Currently, you can't. There is currently no mechanism in Ethereal to support more than one conversation with the same endpoint addresses and port numbers; such a mechanism would have to be added. Such a mechanism would have to somehow arrange that more than one conversation with the same endpoint addresses and port numbers exist, and that the conversations be distinguished by something such as ranges of frame numbers, so that a query searching for a conversation would also take a frame number as an argument, and only a conversation whose range of frame numbers includes that frame would be found. The frame number argument would probably be the frame number of the frame being dissected. In addition, the TCP dissector would have to "close" a conversation either when it detects that a TCP connection has ended or that a new connection has started.
