Hi: I am dissecting messages, running on top of TCP. Some of them are large, and get fragmented. Thus, I am getting a "short frame" printout next to the message's protocol tree node. TCP handoff-s to my dissector based on a port number (I know that on this port I will only be receiving the messages that I am dissecting). I followed indtructions from a Jan'03 post on how to instruct ethereal/tethereal defragment fragmented TCP messages. The problem, however, stil reoccurs. I think this happens because the message(s) that carry the remaining payload are handed off to my dissector again (through the TCP dissector cause the port matches), where I cannot do much, since the load starts from the previous cutoff point. Is there anything I can do here to fix this? I'll greatly appreciate your help.
Thanks, Nik ************************** Nik Kolev Drexel University Major: Computer Science [EMAIL PROTECTED] **************************
