On Feb 22, 2009, at 2:14 PM, יוני תובל wrote:
what length exactly shoild i return in the "get_len" function .
Do i need to return the expecte length of the PDU ?
Yes. That lets tcp_dissect_pdus() know how much data needs to be
assembled.
and if so , what is the definition of the PDU (application layer
data + header , or only data )
The PDU (obviously) doesn't include TCP or IP or link-layer headers
(given that PDUs for protocols running over TCP can be split across
TCP segments), but it does include all the fields for the protocol
running on top of TCP - including any header that gives the length of
the PDU (for protocols, such as DNS, that run over TCP and packet-
oriented transport layers such as UDP).