Re: [Ethereal-users] How to modify the raw hex data display in ethereal?

[Guy Harris <gharris@xxxxxxxxx>]

Jayanna, Jay wrote:

> I am working on reassembling fragmented packets over UDP

We already reassemble fragmented IP datagrams, so you're not referring 
to UDP datagrams that are themselves fragmented.

Are you referring to some protocol that runs over UDP, and that sends a 
packet as one or more fragments, with each fragment being a UDP datagram?

> on a linux box.

The OS doesn't matter.

> I have reassembled the raw hex data. I am able to decode the reassembled 
> data in the 2^nd window pane that has the all the network layer info 
> correctly. But I am not able to modify the raw hex data that I see in 
> the 3^rd pane. It just shows the data part of the last fragment.

You have to register the reassembled data as a "data source".

"process_reassembled_data()" will do a lot of the work for you, 
including that.  Look at some of the dissectors that call it.