Hi, Le lundi 16 mars 2009 à 13:39 +0100, Toralf Förster a écrit : > Hello, > > for the attached dissector > (https://www.wireshark.org/lists/wireshark-users/200902/msg00197.html) I'm > wondering why the statistics doesn't work as expected. The attached tcp > packet contains 2 sametime messages. The 1st message is of type "channel You can't reuse the same sinfo structure, you have to allocate one per PDU. ep_alloc is ok for that:
sinfo = ep_alloc(sizeof(struct SametimeTap )); More remarks: - Don't put all your code in one big 'if (tree) {}' block. If you don't expect thousand of packets/second don't bother with 'if (tree)' at all. - tcp_dissect_pdus with a minimum size of 0? it won't be able to reassemble all cases, as a matter of I'm not sure that the tcp_dissect_xxx really works with a size of 0. With your protocol structure, as describe in the dissector, you can't use tcp_dissect_pdus reliably. It doesn't work if in the same tcp segment you have: <heart beat><long packet> With <hear beat> size <= 4 and <long packet> size > 8 For long packet you must use 8 as tcp_dissect_pdus parameter, and so on. There's no easy workaround though. Didier ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe