Problem with the PDK

[sarlhac]

Hi !

I use the PDK to develop my own protocol interpreter. It works fine but I still have one problem:

A message may be on several TCP segments. I would like to reassemble them before interpret them. PRESCAN's functions are made for this but I can't use it.

My pds is never called in PRESCAN mode.
Is there someone who know why ?

Please I'm really blocked !
Thanks !!

 

[cpete]

The problem is more than likely as a reult of not registering your protocol correctly. You need to use regregister1() instead of regregister() if you want to reassemble your protocol.

Chris

 

[sarlhac]

I use RegRegister1( ) and ReBindList ( ) but I'm sur that PRESCAN mode is never called, so I can't use SarAddDU.
I tried all the possibilities (SAR_SEQ_BY_BYTES, SAR_CHECK_REKEY_ZERO , SAR_NEEDS_CIRCUIT ...) but it's not better.

RegRegister1(hRegInfo,
PROTO_SUITE_USER,
PROTO_ID_DVB,
interp_dvb_simulcrypt,
LONG_NAME_DVB_Simulcrypt,
LAYER_ID_DVB_Simulcrypt,
"DVB",
NULL,
0,
0,
SAR_CHECK_REKEY_ZERO)
(My protocol is DVB_Simulcrypt)

RegBindList(hRegInfo,
PROTO_TCP,
PROTO_ID_DVB,
BIND_FLAGS_PORT,
list);
with list a good list of long.

Steph

 

[cpete]

Steph,

Make sure the tracefile does not have any frame-slicing in it. Pre-Scan is not called if you have any frame-slicing.

Chris

 

[sarlhac]

How can I be sure that my tracefile does not have frame-slicing in it ?
Thanks !

Steph.

 

[cpete]

Steph,

Pick one of the larger frames in the tracefile. Look at the DLC layer. If it has been sliced, you will see a message like the following -

(Only the first 256 of the 1514 bytes were captured).

I am also researching another possibility for your problem. I will get back to you when I know more details.

Chris

 

[cpete]

It seems likely that there is a bug in the baseline product that affects the PDK and prescan. This problem would be present in 4.5 and 4.7. I'll let you know about the possibility of a patch as soon as I know.

Chris

 

[sarlhac]

Chris,

I've no problem with the DLC layer ...
Thanks you very much for your responses. You've help me a lot.
Yes, I would be happy to have a patch.

Thanks,

Steph (a french developer)

 

[varsid]

Has the "TCP segment reassembly patch" identified by cpete ever been implemented? I recently encountered this feature and would appreciate any known workarounds.

Thanks,
Vic