Forum Discussion
Tiaan_92076
Aug 19, 2009Nimbostratus
So Wireshark can reassemble the packet because it understands the protocol, GIOP in this case, and already have all the TCP segments ?
I've looked at the suggestion to parse the protocol headers for the length of the packet. GIOP has a header for message size, but there are multiple GIOP messages per TCP segment. Determining the number of GIOP messages and summing the message size headers would probably be a more expensive operation than just checking the end of the payload for a specific string ?