trema 0.1.3

data/src/tremashark/pcap_queue.h

@@ -0,0 +1,58 @@
+/*
+ * Queue implementation for keeping pcap formatted packets.
+ * 
+ * Author: Yasunori Nakazawa, Yasunobu Chiba
+ *
+ * Copyright (C) 2008-2012 NEC Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+
+#ifndef PCAP_QUEUE_H
+#define PCAP_QUEUE_H
+
+
+#include "trema.h"
+
+
+typedef enum {
+  QUEUE_SUCCESS,
+  QUEUE_FULL,
+  QUEUE_EMPTY
+} queue_status;
+
+
+bool create_pcap_queue( void );
+bool delete_pcap_queue( void );
+buffer* create_pcap_packet( void* pcap_header, size_t pcap_len, void* dump_header, size_t dump_len, void* data, size_t data_len );
+bool delete_pcap_packet( buffer *packet );
+queue_status enqueue_pcap_packet( buffer *packet );
+queue_status peek_pcap_packet( buffer **packet );
+queue_status dequeue_pcap_packet( buffer **packet );
+bool sort_pcap_queue( void );
+void set_max_pcap_queue_length( int length );
+int get_pcap_queue_length( void );
+void foreach_pcap_queue( void function( buffer *data ) );
+
+
+#endif // PCAP_QUEUE_H
+
+
+/*
+ * Local variables:
+ * c-basic-offset: 2
+ * indent-tabs-mode: nil
+ * End:
+ */

data/src/tremashark/plugin/.gitignore

@@ -0,0 +1,6 @@
+/.deps
+/*.a
+/*.so
+/TAGS
+/tmp
+wireshark*

data/src/tremashark/plugin/packet-trema/.gitignore

@@ -0,0 +1,5 @@
+/.deps
+/*.a
+/*.so
+/TAGS
+/tmp

data/src/tremashark/plugin/packet-trema/Makefile

@@ -0,0 +1,77 @@
+WIRESHARK_SRC_DIR = ../wireshark
+
+SRCS   = packet-trema.c plugin.c
+CC     = gcc
+OBJS   = $(foreach src, $(SRCS), $(src:.c=.o))
+
+PLUGIN_NAME = packet-trema
+
+# local installation path
+LOCAL_PLUGIN_DIR  = /home/$(shell whoami)/.wireshark/plugins
+
+# determine global installation path (use latest plugin version path)
+ifneq ($(wildcard /usr/local/lib/wireshark/plugins),)
+	GLOBAL_PLUGIN_DIR_PARTIAL=/usr/local/lib/wireshark/plugins
+else ifneq ($(wildcard /usr/lib/wireshark/plugins),)
+	GLOBAL_PLUGIN_DIR_PARTIAL=/usr/lib/wireshark/plugins
+endif
+
+# Work out if there are version-specific subdirectories
+GLOBAL_PLUGIN_DIR_FILES := $(wildcard $(GLOBAL_PLUGIN_DIR_PARTIAL)/*)
+GLOBAL_PLUGIN_DIR_SUBDIRS := $(foreach file,$(GLOBAL_PLUGIN_DIR_FILES),$(dir $(wildcard $(file)/.)))
+GLOBAL_PLUGIN_DIR_SUBDIRS := $(subst $(GLOBAL_PLUGIN_DIR_PARTIAL)/,,$(GLOBAL_PLUGIN_DIR_SUBDIRS))
+GLOBAL_PLUGIN_DIR_SUBDIRS := $(subst /,,$(GLOBAL_PLUGIN_DIR_SUBDIRS))
+
+# Assume that the "last" directory is the one we ant to use if it exists
+GLOBAL_PLUGIN_VER := $(lastword $(sort $(GLOBAL_PLUGIN_DIR_SUBDIRS)))
+
+# Create the actual global plugin dir to use
+ifneq ($(GLOBAL_PLUGIN_VER),)
+	GLOBAL_PLUGIN_DIR=$(GLOBAL_PLUGIN_DIR_PARTIAL)/$(GLOBAL_PLUGIN_VER)
+else
+	GLOBAL_PLUGIN_DIR=$(GLOBAL_PLUGIN_DIR_PARTIAL)
+endif
+
+OSTYPE = $(shell uname)
+ifeq ($(OSTYPE),Linux)
+ENDIAN=-D_LITTLE_ENDIAN_
+endif
+ifeq ($(OSTYPE),SunOS)
+ENDIAN=-D_BIG_ENDIAN_
+endif
+
+INC_GLIB = -I/usr/include/glib-2.0 -I/usr/local/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/lib/i386-linux-gnu/glib-2.0/include 
+INC_OPENFLOW = -I../../../../objects/openflow
+INC_TREMA = -I../../../lib
+
+INC_DIRS = -I. $(INC_GLIB) $(INC_OPENFLOW) $(INC_TREMA)
+CFLAGS = -std=gnu99 -D_GNU_SOURCE $(INC_DIRS) -DHAVE_CONFIG_H -I$(WIRESHARK_SRC_DIR) -I/usr/local/include -I/usr/local/include -DINET6 -D_U_=__attribute__\(\(unused\)\) -Wall -Wpointer-arith -g -I/usr/local/include -DXTHREADS -D_REENTRANT -DXUSE_MTSAFE_API -pthread -I/usr/include/gtk-2.0 -I/usr/lib/gtk-2.0/include -I/usr/X11R6/include -I/usr/include/atk-1.0 -I/usr/include/pango-1.0 -I/usr/include/freetype2 -I/usr/include/freetype2/config -fPIC -DPIC $(ENDIAN) $(DISSECT_PORT)
+
+LDFLAGS = -Wl,--rpath -Wl,/usr/local/lib -Wl,--rpath -Wl,/usr/local/lib -L/usr/local/lib -L$(WIRESHARK_SRC_DIR)/epan -L. -lgmodule-2.0 -ldl -lglib-2.0 -pthread -Wl,--export-dynamic -Wl,-soname -Wl,$(PLUGIN_NAME).so
+
+.PHONY: clean install
+
+$(PLUGIN_NAME).so : $(OBJS) $(SRCS)
+	$(CC) -shared $(OBJS) $(LDFLAGS) -o $@
+
+install: $(PLUGIN_NAME).so
+	@if [ `id -u` -eq 0 ]; then \
+	  if [ -d "$(GLOBAL_PLUGIN_DIR)" ]; then \
+	    target="$(GLOBAL_PLUGIN_DIR)/$<"; \
+	    res="*** Installed plugin for ALL users ($$target)"; \
+	  else \
+	    echo "*** Error: global plugin directory $(GLOBAL_PLUGIN_DIR) does not exist"; \
+	    exit 1; \
+	  fi; \
+	else \
+	  mkdir -p "$(LOCAL_PLUGIN_DIR)/"; \
+	  target="$(LOCAL_PLUGIN_DIR)/$<"; \
+	  res="*** Installed plugin for user "`id | cut -d\( -f2 | cut -d\) -f1`" ($$target)"; \
+	fi; \
+	install --mode=644 $< "$$target" && echo "" && echo "" && echo "$$res" && echo "" && echo ""
+
+plugin.c: moduleinfo.h Makefile.am Makefile.common
+	$(MAKE) -f Makefile.am
+
+clean:
+	rm -f $(PLUGIN) $(OBJS) $(PLUGIN_NAME).so

data/src/tremashark/plugin/packet-trema/Makefile.am

@@ -0,0 +1,110 @@
+# Makefile.am
+# Automake file for H.223 plugin
+#
+# $Id: Makefile.am 21961 2007-05-27 18:35:55Z guy $
+#
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+
+srcdir = .
+top_srcdir = ../wireshark
+includedir = ../wireshark
+INCLUDES = -I$(top_srcdir) -I$(includedir)
+
+include Makefile.common
+
+#if HAVE_WARNINGS_AS_ERRORS
+#AM_CFLAGS = -Werror
+#endif
+
+plugindir = ~/.wireshark/plugins
+
+plugin_LTLIBRARIES = hsapi.la
+hsapi_la_SOURCES = \
+	plugin.c \
+	moduleinfo.h \
+	$(DISSECTOR_SRC) \
+	$(DISSECTOR_SUPPORT_SRC) \
+	$(DISSECTOR_INCLUDES)
+trema_la_LDFLAGS = -module -avoid-version
+trema_la_LIBADD = @PLUGIN_LIBS@
+
+# Libs must be cleared, or else libtool won't create a shared module.
+# If your module needs to be linked against any particular libraries,
+# add them here.
+LIBS =
+
+#
+# Build plugin.c, which contains the plugin version[] string, a
+# function plugin_register() that calls the register routines for all
+# protocols, and a function plugin_reg_handoff() that calls the handoff
+# registration routines for all protocols.
+#
+# We do this by scanning sources.  If that turns out to be too slow,
+# maybe we could just require every .o file to have an register routine
+# of a given name (packet-aarp.o -> proto_register_aarp, etc.).
+#
+# Formatting conventions:  The name of the proto_register_* routines an
+# proto_reg_handoff_* routines must start in column zero, or must be
+# preceded only by "void " starting in column zero, and must not be
+# inside #if.
+#
+# DISSECTOR_SRC is assumed to have all the files that need to be scanned.
+#
+# For some unknown reason, having a big "for" loop in the Makefile
+# to scan all the files doesn't work with some "make"s; they seem to
+# pass only the first few names in the list to the shell, for some
+# reason.
+#
+# Therefore, we have a script to generate the plugin.c file.
+# The shell script runs slowly, as multiple greps and seds are run
+# for each input file; this is especially slow on Windows.  Therefore,
+# if Python is present (as indicated by PYTHON being defined), we run
+# a faster Python script to do that work instead.
+#
+# The first argument is the directory in which the source files live.
+# The second argument is "plugin", to indicate that we should build
+# a plugin.c file for a plugin.
+# All subsequent arguments are the files to scan.
+#
+plugin.c: $(DISSECTOR_SRC) $(top_srcdir)/tools/make-dissector-reg \
+    $(top_srcdir)/tools/make-dissector-reg.py
+	@if test -n $(PYTHON); then \
+		echo Making plugin.c with python ; \
+		$(PYTHON) $(top_srcdir)/tools/make-dissector-reg.py $(srcdir) \
+		    plugin $(DISSECTOR_SRC) ; \
+	else \
+		echo Making plugin.c with shell script ; \
+		$(top_srcdir)/tools/make-dissector-reg $(srcdir) \
+		    $(plugin_src) plugin $(DISSECTOR_SRC) ; \
+	fi
+
+#
+# Currently plugin.c can be included in the distribution because
+# we always build all protocol dissectors. We used to have to check
+# whether or not to build the snmp dissector. If we again need to
+# variably build something, making plugin.c non-portable, uncomment
+# the dist-hook line below.
+#
+# Oh, yuk.  We don't want to include "plugin.c" in the distribution, as
+# its contents depend on the configuration, and therefore we want it
+# to be built when the first "make" is done; however, Automake insists
+# on putting *all* source into the distribution.
+#
+# We work around this by having a "dist-hook" rule that deletes
+# "plugin.c", so that "dist" won't pick it up.
+#
+#dist-hook:
+#	@rm -f $(distdir)/plugin.c
+
+CLEANFILES = \
+	*.so \
+	*~
+
+MAINTAINERCLEANFILES = \
+	Makefile.in	\
+	plugin.c
+
+EXTRA_DIST = \
+	Makefile.common

data/src/tremashark/plugin/packet-trema/Makefile.common

@@ -0,0 +1,31 @@
+#
+# Author: Yasunobu Chiba
+#
+# Copyright (C) 2008-2012 NEC Corporation
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2, as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+# the name of the plugin
+PLUGIN_NAME = trema
+
+# the dissector sources (without any helpers)
+DISSECTOR_SRC = packet-trema.c
+
+# corresponding headers
+DISSECTOR_INCLUDES =
+
+# Dissector helpers.  They're included in the source files in this
+# directory, but they're not dissectors themselves, i.e. they're not
+# used to generate "register.c").
+DISSECTOR_SUPPORT_SRC =	

data/src/tremashark/plugin/packet-trema/moduleinfo.h

@@ -0,0 +1,41 @@
+/*
+ * Package name and version definition of tremashark
+ *
+ * Author: Yasunobu Chiba, Yasunori Nakazawa
+ *
+ * Copyright (C) 2008-2012 NEC Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+
+#ifdef PACKAGE
+#undef PACKAGE
+#endif
+
+#define PACKAGE "trema"
+
+#ifdef VERSION
+#undef VERSION
+#endif
+
+#define VERSION "0.1.1"
+
+
+/*
+ * Local variables:
+ * c-basic-offset: 2
+ * indent-tabs-mode: nil
+ * End:
+ */

data/src/tremashark/plugin/packet-trema/packet-trema.c

@@ -0,0 +1,1659 @@
+/*
+ * Author: Yasunobu Chiba, Yasunori Nakazawa
+ *
+ * Copyright (C) 2008-2012 NEC Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <glib.h>
+#include <epan/emem.h>
+#include <epan/packet.h>
+#include <epan/dissectors/packet-tcp.h>
+#include <epan/prefs.h>
+#include <epan/ipproto.h>
+#include <epan/etypes.h>
+#include <epan/addr_resolv.h>
+#include <epan/reassemble.h>
+#include <pcap/pcap.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include "messenger.h"
+#include "openflow_service_interface.h"
+
+
+#define PROTO_TAG_TREMA  "TREMA"
+
+#define NO_STRINGS NULL
+#define NO_MASK 0x0
+
+#define UDP_PORT_SYSLOG 514
+
+
+// Macro for debug use
+//#define PRINTF( ... ) printf( __VA_ARGS__ )
+#define PRINTF( ... )
+
+
+// Wireshark ID
+static int proto_trema = -1;
+//static dissector_handle_t trema_handle;
+static void dissect_trema( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree );
+
+
+// Structure defined in tremashark.c
+typedef struct message_pcap_dump_header {
+  uint16_t dump_type;
+  struct {
+    uint32_t sec;
+    uint32_t nsec;
+  } sent_time;
+  uint16_t app_name_len;
+  uint16_t service_name_len;
+  uint32_t data_len;
+}  __attribute__( ( packed ) ) message_pcap_dump_header;
+
+typedef struct stream_id {
+  gchar *app_name;
+  guint16 app_name_length;
+  gchar *service_name;
+  guint16 service_name_length;
+} stream_id;
+
+// Fragmented stream information
+typedef struct fragmented_stream_info {
+  stream_id stream_name;      // app name and service name pair
+  gint32 unreceived_length;   // unreceived length
+  guint32 message_length;     // expected message length
+  guint32 reassemble_id;      // unique id for reassembling
+  guint32 number;             // fragment count of the stream. start from 0.
+  gboolean temporary_length;  // set TRUE until it received message_header.
+} fragmented_stream_info;
+
+// Packet status information
+typedef struct packet_status_info {
+  guint32 packet_number;
+  guint32 reassemble_id;
+} packet_status_info;
+
+
+// OpenFlow dissector
+static dissector_handle_t openflow_handle = NULL;
+
+// Ethernet dissector
+static dissector_handle_t ethernet_handle = NULL;
+
+// PPP dissector
+static dissector_handle_t ppp_handle = NULL;
+
+// IPv4 dissector
+static dissector_handle_t ip_handle = NULL;
+
+// Linux SLL dissector table
+static dissector_table_t sll_dissector_table = NULL;
+
+// UDP dissector table
+static dissector_table_t udp_dissector_table = NULL;
+
+// Fragment tables
+static GHashTable *trema_fragment_table = NULL;
+static GHashTable *trema_reassembled_table = NULL;
+
+// Fragment status list
+static GList *fragments_status = NULL;
+static packet_status_info **packets_status = NULL;
+static guint32 packets_status_size = 0;   // allocated element count of packets_status;
+
+// Header fields
+static gint hf_dump_header = -1;
+static gint hf_dump_type = -1;
+static gint hf_dump_event_time = -1;
+static gint hf_dump_app_name_length = -1;
+static gint hf_dump_service_name_length = -1;
+static gint hf_dump_data_length = -1;
+static gint hf_dump_app_name = -1;
+static gint hf_dump_service_name = -1;
+static gint hf_message_header = -1;
+static gint hf_version = -1;
+static gint hf_message_type = -1;
+static gint hf_tag = -1;
+static gint hf_message_length = -1;
+static gint hf_service_header = -1;
+static gint hf_context_handle = -1;
+static gint hf_datapath_id = -1;
+static gint hf_service_name_length = -1;
+static gint hf_service_name = -1;
+static gint hf_transaction_id = -1;
+static gint hf_hex_dump = -1;
+static gint hf_pcap_dump_header = -1;
+static gint hf_pcap_dump_datalink = -1;
+static gint hf_pcap_dump_interface = -1;
+static gint hf_pcap_pkthdr = -1;
+static gint hf_pcap_pkthdr_ts = -1;
+static gint hf_pcap_pkthdr_caplen = -1;
+static gint hf_pcap_pkthdr_len = -1;
+static gint hf_syslog_dump_header = -1;
+static gint hf_syslog_dump_receive_time = -1;
+static gint hf_syslog_dump_message = -1;
+static gint hf_text_dump_header = -1;
+static gint hf_text_dump_receive_time = -1;
+static gint hf_text_dump_string = -1;
+
+// Subtrees
+static gint ett_trema = -1;
+static gint ett_dump_header = -1;
+static gint ett_message_header = -1;
+static gint ett_service_header = -1;
+static gint ett_context_handle = -1;
+static gint ett_pcap_dump_header = -1;
+static gint ett_pcap_pkthdr = -1;
+static gint ett_syslog_dump_header = -1;
+static gint ett_text_dump_header = -1;
+
+// Fragment subtrees
+static gint ett_trema_fragment = -1;
+static gint ett_trema_fragments = -1;
+
+// Fragment fields
+static int hf_trema_fragments = -1;
+static int hf_trema_fragment = -1;
+static int hf_trema_fragment_overlap = -1;
+static int hf_trema_fragment_overlap_conflict = -1;
+static int hf_trema_fragment_multiple_tails = -1;
+static int hf_trema_fragment_too_long_fragment = -1;
+static int hf_trema_fragment_error = -1;
+
+// Reassembled in field
+static int hf_trema_reassembled_in = -1;
+
+// Reassembled length field
+static int hf_trema_reassembled_length = -1;
+
+
+enum {
+  MESSAGE_TYPE_NOTIFY,
+  MESSAGE_TYPE_REQUEST,
+  MESSAGE_TYPE_REPLY,
+};
+
+
+// Names to bind to various values in the type field
+static const value_string names_dump_type[] = {
+  { MESSENGER_DUMP_SENT, "Sent" },
+  { MESSENGER_DUMP_RECEIVED, "Received" },
+  { MESSENGER_DUMP_RECV_CONNECTED, "Receive Connected" },
+  { MESSENGER_DUMP_RECV_OVERFLOW, "Receive Overflow" },
+  { MESSENGER_DUMP_RECV_CLOSED, "Receive Closed" },
+  { MESSENGER_DUMP_SEND_CONNECTED, "Send Connected" },
+  { MESSENGER_DUMP_SEND_REFUSED, "Send Refused" },
+  { MESSENGER_DUMP_SEND_OVERFLOW, "Send Overflow" },
+  { MESSENGER_DUMP_SEND_CLOSED, "Send Closed" },
+  { MESSENGER_DUMP_LOGGER, "Log Message" },
+  { MESSENGER_DUMP_PCAP, "Packet Capture" },
+  { MESSENGER_DUMP_SYSLOG, "Syslog" },
+  { MESSENGER_DUMP_TEXT, "Text" },
+  { 0, NULL },
+};
+
+static const value_string names_message_type[] = {
+  { MESSAGE_TYPE_NOTIFY, "Notify" },
+  { MESSAGE_TYPE_REQUEST, "Request" },
+  { MESSAGE_TYPE_REPLY, "Reply" },
+  { 0, NULL },
+};
+
+static const value_string names_service_tag[] = {
+  { MESSENGER_OPENFLOW_MESSAGE, "OpenFlow Message" },
+  { MESSENGER_OPENFLOW_CONNECTED, "Switch Connected" },
+  { MESSENGER_OPENFLOW_READY, "Switch Ready" },
+  { MESSENGER_OPENFLOW_DISCONNECTED, "Switch Disconnected" },
+  { 0, NULL },
+};
+
+// Names to bind to various datalink type values
+static const value_string names_datalink_type[] = {
+  { DLT_EN10MB, "Ethernet (10Mb)" },
+  { DLT_PPP, "Point-to-point protocol" },
+  { DLT_RAW, "Raw IP" },
+  { DLT_LINUX_SLL, "Linux cooked sockets" },
+  { 0, NULL },
+};
+
+static const fragment_items trema_fragment_items = {
+  // Fragment subtrees
+  &ett_trema_fragment,
+  &ett_trema_fragments,
+  // Fragment fields
+  &hf_trema_fragments,
+  &hf_trema_fragment,
+  &hf_trema_fragment_overlap,
+  &hf_trema_fragment_overlap_conflict,
+  &hf_trema_fragment_multiple_tails,
+  &hf_trema_fragment_too_long_fragment,
+  &hf_trema_fragment_error,
+  // Reassembled in field
+  &hf_trema_reassembled_in,
+  // Reassembled length field
+  &hf_trema_reassembled_length,
+  // Tag
+  "Trema fragments"
+};
+
+
+/** Check the status whether the packet_number exists.
+ *
+ *  return TRUE when it exists.
+ */
+static gboolean
+check_packet_status( guint32 packet_number ) {
+  if ( packet_number == 0 || packet_number > packets_status_size ) {
+    return FALSE;
+  }
+  
+  if ( packets_status[ packet_number - 1 ] ) {
+    return TRUE;
+  }
+  return FALSE;
+}
+
+
+/** Update packet_status
+ *
+ *  This function would overwrite information when any data already exists.
+ */
+static void
+update_packet_status( guint32 packet_number, guint32 reassemble_id ) {
+  const guint32 PACKET_STATUS_CHUNK_SIZE = 1000;
+  
+  guint32 current_size = packets_status_size;
+  packet_status_info *p = NULL;
+
+  // This should use '>=' to keep NULL termination for free.
+  while ( packet_number >= packets_status_size ) {
+    packets_status_size += PACKET_STATUS_CHUNK_SIZE;
+  }
+
+  if ( packets_status_size > current_size ) {
+    // extend pointer table
+    packet_status_info **new_table_buffer = g_malloc( packets_status_size * sizeof( packet_status_info * ) );
+    memset( new_table_buffer, 0, packets_status_size * sizeof( packet_status_info * ) );
+    if ( packets_status != NULL ) {
+      memcpy( ( void * )new_table_buffer, ( void * )packets_status, current_size * sizeof( packet_status_info * ) );
+      g_free( packets_status );
+    }
+    packets_status = new_table_buffer;
+  }
+
+  if ( packets_status[ packet_number - 1 ] == NULL ) {
+    packets_status[ packet_number - 1 ] = g_malloc( sizeof( packet_status_info ) );
+  }
+  p = packets_status[ packet_number - 1 ];
+  p->packet_number = packet_number;
+  p->reassemble_id = reassemble_id;
+}
+
+
+/** Get packet status information
+ */
+static packet_status_info *
+get_packet_status( guint32 packet_number ) {
+  packet_status_info *p = NULL;
+  
+  if ( check_packet_status( packet_number ) ) {
+    p = packets_status[ packet_number - 1 ];
+  }
+
+  return p;
+}
+
+
+/** Clear packet status
+ */
+static void
+clear_packet_status() {
+  if ( packets_status != NULL ) {
+    guint count;
+    
+    for ( count = 0; count < packets_status_size; count++ ) {
+      if ( packets_status[ count ] ) {
+        g_free( packets_status[ count ] );
+      }
+    }
+    g_free( packets_status );
+    packets_status = NULL;
+    packets_status_size = 0;
+  }
+}
+
+
+/** Get app name and service name, this pair can be used as stream name.
+ */
+static void
+get_stream_id( tvbuff_t *tvb, stream_id *stream_name ) {
+  assert( tvb != NULL );
+  assert( stream_name != NULL );
+
+  stream_name->app_name_length = tvb_get_ntohs( tvb, offsetof( message_pcap_dump_header, app_name_len ) );
+  stream_name->app_name = tvb_format_text( tvb, sizeof( message_pcap_dump_header ), stream_name->app_name_length - 1 );
+  stream_name->service_name_length = tvb_get_ntohs( tvb, offsetof( message_pcap_dump_header, service_name_len ) );
+  stream_name->service_name = tvb_format_text( tvb, sizeof( message_pcap_dump_header ) + stream_name->app_name_length,
+                                               stream_name->service_name_length - 1 );
+}
+
+
+/** Generate a unique reassemble_id.
+ */
+static guint32
+generate_reassemble_id() {
+  guint32 new_id = 1;   // The lowest id is 1, 0 means non fragmentation
+
+  if ( packets_status != NULL ) {
+    guint count;
+
+    for ( count = 0; count < packets_status_size; count++ ) {
+      if ( packets_status[ count ] ) {
+        packet_status_info *p = packets_status[ count ];
+        if ( new_id == p->reassemble_id ) {
+          new_id++;
+          count = 0;
+          continue;
+        }
+      }
+    }
+  }
+
+  return new_id;
+}
+
+
+/** Confirm status of fragment whether it received enough fragments or not.
+ *
+ *  return TRUE if the stream information indicates it needs more fragment,
+ *  FALSE means the stream has enough fragments, it can be reassembled.
+ */
+static gboolean
+is_last_fragment( fragmented_stream_info* fragment_info ) {
+  assert( fragment_info != NULL );
+
+  if ( fragment_info->unreceived_length <= 0 ) {
+    return FALSE;
+  }
+  return TRUE;
+}
+
+
+/** Trim a message from packet payload.
+ *
+ *  'offset' points at message header.
+ *  Return new subset tvbuff of a message.
+ *  If given tvb is not enough length, return NULL.
+ */
+static tvbuff_t *
+trim_message( tvbuff_t *tvb, gint offset ) {
+  guint32 length = tvb_length( tvb );
+  guint32 message_length;
+
+  assert( tvb != NULL );
+
+  if ( length < sizeof( message_header ) ) {
+    PRINTF( "trim() failed  length %d\n", length );
+    return NULL;
+  }
+  message_length = tvb_get_ntohl( tvb, offset + offsetof( message_header, message_length ) );
+  if ( length < message_length ) {
+    PRINTF( "trim() failed  length %d  message_length %d\n", length, message_length );
+    return NULL;
+  }
+  return tvb_new_subset( tvb, offset, message_length, message_length );
+}
+
+
+/** Get fragmented_stream_info from the current fragments_status by stream_name.
+ */
+static fragmented_stream_info *
+get_fragmented_stream_info( stream_id *stream_name ) {
+  GList *element;
+
+  assert( stream_name != NULL );
+
+  if ( fragments_status == NULL ) {
+    return NULL;
+  }
+
+  for ( element = g_list_first( fragments_status ); element != NULL; element = element->next ) {
+    if ( element->data != NULL ) {
+      fragmented_stream_info *fragment_info = element->data;
+      if ( strncmp( fragment_info->stream_name.app_name, stream_name->app_name, stream_name->app_name_length - 1 ) == 0 &&
+           strncmp( fragment_info->stream_name.service_name, stream_name->service_name, stream_name->service_name_length - 1 ) == 0 ) {
+        return fragment_info;
+      }
+    }
+  }
+
+  return NULL;
+}
+
+
+/** Add a new fragmented stream information to fragment status list.
+ *
+ *  'offset' points at begging of messages.
+ *  return updated fragmented streasm info.
+ */
+static fragmented_stream_info *
+add_fragmented_stream_info( tvbuff_t *tvb, gint offset, stream_id *stream_name ) {
+  fragmented_stream_info *fragment_info;
+
+  assert( tvb != NULL );
+  assert( stream_name != NULL );
+  assert( get_fragmented_stream_info( stream_name ) == NULL );
+
+  PRINTF( "  ** add_fragmented_stream_info\n" );
+  guint32 received_message_length = tvb_length_remaining( tvb, offset );
+  fragment_info = g_malloc( sizeof( fragmented_stream_info ) );
+  fragment_info->stream_name.app_name = g_malloc( stream_name->app_name_length );
+  memset( fragment_info->stream_name.app_name, ( int )NULL, stream_name->app_name_length );
+  strncpy( fragment_info->stream_name.app_name, stream_name->app_name, stream_name->app_name_length - 1 );
+  fragment_info->stream_name.app_name_length = stream_name->app_name_length;
+  fragment_info->stream_name.service_name = g_malloc( stream_name->service_name_length );
+  memset( fragment_info->stream_name.service_name, ( int )NULL, stream_name->service_name_length );
+  strncpy( fragment_info->stream_name.service_name, stream_name->service_name, stream_name->service_name_length - 1 );
+  fragment_info->stream_name.service_name_length = stream_name->service_name_length;
+  if ( received_message_length < sizeof( message_header ) ) {
+    /* this case cannot calculate message length until reassembling message_header.
+     * we need next fragment to build whole message_header.
+     */
+    PRINTF( "  - received stream is less than message_header\n" );
+    fragment_info->message_length = sizeof( message_header );
+    fragment_info->temporary_length = TRUE;
+  }
+  else {
+    fragment_info->message_length = tvb_get_ntohl( tvb, offset + offsetof( message_header, message_length ) );
+    fragment_info->temporary_length = FALSE;
+  }
+  
+  fragment_info->unreceived_length = fragment_info->message_length - received_message_length;
+  fragment_info->reassemble_id = generate_reassemble_id();
+  fragment_info->number = 0;
+
+  fragments_status = g_list_prepend( fragments_status, fragment_info );
+
+  PRINTF( "  - unreceived_length %d  message_length %u  reassemble_id %d\n",
+          fragment_info->unreceived_length, fragment_info->message_length, fragment_info->reassemble_id );
+
+  return fragment_info;
+}
+
+
+/** Reset fragmented stream information with reassembled message which includes message_header.
+ *  This function should be invoked when message_header is reassembled.
+ *
+ *  return updated fragmented streasm info.
+ */
+static fragmented_stream_info *
+reset_fragmented_stream_info( tvbuff_t *reassembled_tvb, fragmented_stream_info *fragment_info ) {
+  guint32 received_message_length;
+
+  assert( reassembled_tvb != NULL );
+  assert( fragment_info != NULL );
+  assert( fragment_info->temporary_length == TRUE );
+
+  PRINTF( "  ** reset_fragmented_stream_info  reassemble_id %d\n", fragment_info->reassemble_id );
+  received_message_length = tvb_reported_length( reassembled_tvb );
+  assert( received_message_length >= sizeof( message_header ) );
+
+  fragment_info->message_length = tvb_get_ntohl( reassembled_tvb, offsetof( message_header, message_length ) );
+  fragment_info->unreceived_length = fragment_info->message_length - received_message_length;
+  fragment_info->temporary_length = FALSE;
+
+  PRINTF( "  - unreceived_length %d  message_length %u  reassemble_id %d\n",
+          fragment_info->unreceived_length, fragment_info->message_length, fragment_info->reassemble_id );
+  return fragment_info;
+}
+
+
+/** Update fragment status list with new fragmented stream information.
+ *
+ *  'offset' points at beginning of inner message.
+ *  return updated fragmented streasm info.
+ */
+static fragmented_stream_info *
+update_fragmented_stream_info( tvbuff_t *tvb, gint offset, fragmented_stream_info *fragment_info ) {
+  assert( tvb != NULL );
+  assert( fragment_info != NULL );
+
+  PRINTF( "  ** update_fragmented_stream_info  reassemble_id %d\n", fragment_info->reassemble_id );
+  fragment_info->unreceived_length -= tvb_reported_length_remaining( tvb, offset );
+  fragment_info->number++;
+  PRINTF( "  - unreceived_length %d  message_length %u  reassemble_id %d\n",
+          fragment_info->unreceived_length, fragment_info->message_length, fragment_info->reassemble_id );
+  return fragment_info;
+}
+
+
+/** Inner function to remove fragmented stream information in dlist
+ */
+static void
+free_fragmented_stream_info( fragmented_stream_info *info ) {
+  if ( info != NULL ) {
+    g_free( info->stream_name.app_name );
+    g_free( info->stream_name.service_name );
+    g_free( info );
+  }
+}
+
+
+/** Inner function to remove fragmented stream information in dlist
+ */
+static void
+delete_fragmented_stream_info( fragmented_stream_info *fragment_info ) {
+  if ( fragment_info != NULL ) {
+    fragments_status = g_list_remove( fragments_status, fragment_info );
+    free_fragmented_stream_info( fragment_info );
+  }
+}
+
+
+/** Remove a fragment stream information from fragment status list.
+ */
+static gboolean
+remove_fragmented_stream_info( fragmented_stream_info *fragment_info ) {
+  GList *element;
+  
+  assert( fragment_info != NULL );
+
+  PRINTF( "  ** remove_fragmented_stream_info  reassemble_id %d\n", fragment_info->reassemble_id );
+  if ( fragments_status == NULL ) {
+    return FALSE;
+  }
+
+  element = g_list_find( fragments_status, fragment_info );
+  if ( element == NULL ) {
+    return FALSE;
+  }
+  delete_fragmented_stream_info( element->data );
+ 
+  return TRUE;
+}
+
+
+static void
+clear_fragmented_stream_info_walker( gpointer fragment_info, gpointer user_data ) {
+  if ( fragment_info != NULL ) {
+    free_fragmented_stream_info( fragment_info );
+  }
+}
+
+
+/** Clear all fragment status
+ */
+static void
+clear_fragmented_stream_info() {
+  PRINTF( "  ** clear_fragmented_stream_info\n" );
+
+  if ( fragments_status != NULL ) {
+    g_list_foreach( fragments_status, clear_fragmented_stream_info_walker, NULL );
+    g_list_free( fragments_status );
+    fragments_status = NULL;
+  }
+}
+
+
+/** Add a new fragmented message to hash table and reassemble the fragments if possible.
+ *
+ *  'offset' which point at beginning of message.
+ *  'fragment_info' has fragment information of target stream.
+ *
+ *  return NULL if there is not enough fragments yet.
+ */
+static tvbuff_t *
+reassemble_message( tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, fragmented_stream_info *fragment_info ) {
+  packet_status_info *packet_status;
+  gboolean save_fragmented;
+  gboolean more_fragment;
+  fragment_data *fragment_message;
+  tvbuff_t *new_tvb;
+
+  assert( tvb != NULL );
+  assert( pinfo != NULL );
+  assert( tree != NULL );
+  assert( fragment_info != NULL );
+
+  packet_status = get_packet_status( pinfo->fd->num );
+  assert( packet_status != NULL );
+
+  save_fragmented = pinfo->fragmented;
+  more_fragment = is_last_fragment( fragment_info );
+
+  pinfo->fragmented = TRUE;
+  fragment_message = fragment_add_seq_next( tvb, offset, pinfo, packet_status->reassemble_id,
+                                            trema_fragment_table, trema_reassembled_table, 
+                                            tvb_length_remaining( tvb, offset ), more_fragment );
+
+  new_tvb = process_reassembled_data( tvb, offset, pinfo, "Reassembled Trema",
+                                      fragment_message, &trema_fragment_items, NULL, tree );
+
+  if ( fragment_message ) {
+    // Reassembled
+    col_append_str( pinfo->cinfo, COL_INFO, " (Message reassembled)" );
+    PRINTF( "   reassemble_message() reassembled\n" );
+  }
+  else {
+    // Not last packet of reassembled
+    col_append_fstr( pinfo->cinfo, COL_INFO, " (Message fragment %u)", fragment_info->number );
+    PRINTF( "   reassemble_message() not last packet\n" );
+  }
+
+  pinfo->fragmented = save_fragmented;
+  return new_tvb;
+}
+
+
+/** Get reassembled message
+ */
+static tvbuff_t *
+get_reassembled_message( tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, stream_id *stream_name ) {
+  unsigned int save_visited;
+  gboolean save_fragmented;
+  gboolean more_fragment;
+  fragmented_stream_info *fragment_info;
+  packet_status_info *packet_status = NULL;
+  fragment_data *fragment_message = NULL;
+  tvbuff_t *reassembled_tvb = NULL;
+
+  assert( tvb != NULL );
+  assert( pinfo != NULL );
+  assert( tree != NULL );
+  assert( stream_name != NULL );
+
+  packet_status = get_packet_status( pinfo->fd->num );
+  assert( packet_status != NULL );
+  
+  more_fragment = FALSE;
+  fragment_info = get_fragmented_stream_info( stream_name );
+  if ( fragment_info != NULL ) {
+    if ( fragment_info->reassemble_id == packet_status->reassemble_id ) {
+      // this fragment has not closed yet, it still needs more packets
+      more_fragment = TRUE;
+    }
+  }
+  save_visited = pinfo->fd->flags.visited;
+  pinfo->fd->flags.visited = 1;
+  save_fragmented = pinfo->fragmented;
+  pinfo->fragmented = TRUE;
+  
+  fragment_message = fragment_add_seq_next( tvb, offset, pinfo, packet_status->reassemble_id,
+                                            trema_fragment_table, trema_reassembled_table,
+                                            tvb_length_remaining( tvb, offset ), more_fragment );
+  reassembled_tvb = process_reassembled_data( tvb, offset, pinfo, "Reassembled Trema",
+                                              fragment_message, &trema_fragment_items, NULL, tree );
+
+  pinfo->fragmented = save_fragmented;
+  pinfo->fd->flags.visited = save_visited;
+
+  return reassembled_tvb;
+}
+
+
+/** Update fragment status and store fragmented stream in hash table.
+ *  if it can reassemble entire message, do it and removes the fragment information.
+ *
+ *  return reassembled stream if possible, otherwise return NULL.
+ */
+static tvbuff_t *
+update_fragment_status( tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree,
+                        fragmented_stream_info *fragment_info, stream_id *stream_name ) {
+  tvbuff_t *reassembled_tvb;
+
+  assert( tvb != NULL );
+  assert( pinfo != NULL );
+  assert( tree != NULL );
+  assert( ( fragment_info != NULL && stream_name == NULL ) ||
+          ( fragment_info == NULL && stream_name != NULL ) );
+
+  if ( fragment_info == NULL ) {
+    fragment_info = add_fragmented_stream_info( tvb, offset, stream_name );
+  }
+  else {
+    fragment_info = update_fragmented_stream_info( tvb, offset, fragment_info );
+  }
+  update_packet_status( pinfo->fd->num, fragment_info->reassemble_id );
+  reassembled_tvb = reassemble_message( tvb, offset, pinfo, tree, fragment_info );
+
+  if ( reassembled_tvb != NULL ) {
+    // reassembled done
+    if ( fragment_info->unreceived_length <= 0 &&
+         fragment_info->temporary_length == TRUE ) {
+      // reassembled one includes at least message_header
+      fragment_info = reset_fragmented_stream_info( reassembled_tvb, fragment_info );
+    }
+
+    if ( fragment_info->unreceived_length <= 0 ) {
+      // reassembled entire message
+      remove_fragmented_stream_info( fragment_info );
+    }
+    else {
+      // reassembled a part of message which includes header
+
+      // store again the reassembled message as a first fragment of whole message
+      reassemble_message( reassembled_tvb, 0, pinfo, tree, fragment_info );
+    }
+  }
+
+  return reassembled_tvb;
+}
+
+
+static void
+init_trema_fragment() {
+  // Initialize tables for reassembling
+  fragment_table_init( &trema_fragment_table );
+  reassembled_table_init( &trema_reassembled_table );
+
+  // Clear fragment status information
+  clear_fragmented_stream_info();
+
+  // Clear packet status information
+  clear_packet_status();
+}
+
+
+static gint
+dissect_message_pcap_dump_header( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree, guint16 *dump_type ) {
+  /*
+    +------------------------+--------+------------+----+
+    |message_pcap_dump_header|app_name|service_name|data|
+    +------------------------+--------+------------+----+
+
+    typedef struct message_pcap_dump_header {
+      uint16_t dump_type;
+      struct {
+        uint32_t sec;
+        uint32_t nsec;
+      } sent_time;
+      uint16_t app_name_len;
+      uint16_t service_name_len;
+      uint32_t data_len;
+    }  __attribute__( ( packed ) ) message_pcap_dump_header;
+  */
+
+  gchar *src, *dst;
+  gint offset = 0;
+  *dump_type = tvb_get_ntohs( tvb, 0 );
+  guint16 app_name_len = tvb_get_ntohs( tvb, offsetof( message_pcap_dump_header, app_name_len ) );
+  guint16 service_name_len = tvb_get_ntohs( tvb, offsetof( message_pcap_dump_header, service_name_len ) );
+
+  if ( check_col( pinfo->cinfo, COL_DEF_SRC ) ) {
+    src = tvb_format_text( tvb, sizeof( message_pcap_dump_header ), app_name_len - 1 );
+    if ( *dump_type != MESSENGER_DUMP_RECEIVED ) {
+      col_add_str( pinfo->cinfo, COL_DEF_SRC, src );
+    }
+  }
+
+  if ( check_col( pinfo->cinfo, COL_DEF_DST ) ) {
+    dst = tvb_format_text( tvb, sizeof( message_pcap_dump_header ) + app_name_len, service_name_len - 1 );
+    col_add_str( pinfo->cinfo, COL_DEF_DST, dst );
+  }
+
+  if ( check_col( pinfo->cinfo, COL_INFO ) ) {
+    switch ( *dump_type ) {
+      case MESSENGER_DUMP_SENT:
+      case MESSENGER_DUMP_RECEIVED:
+      case MESSENGER_DUMP_RECV_CONNECTED:
+      case MESSENGER_DUMP_RECV_OVERFLOW:
+      case MESSENGER_DUMP_RECV_CLOSED:
+      case MESSENGER_DUMP_SEND_CONNECTED:
+      case MESSENGER_DUMP_SEND_REFUSED:
+      case MESSENGER_DUMP_SEND_OVERFLOW:
+      case MESSENGER_DUMP_SEND_CLOSED:
+      {
+        if ( g_strcasecmp( src, dst ) == 0 ) {
+          col_add_fstr( pinfo->cinfo, COL_INFO, "%s (%s)",
+                        src, names_dump_type[ *dump_type ].strptr );
+        }
+        else {
+          col_add_fstr( pinfo->cinfo, COL_INFO, "%s > %s (%s)",
+                        src, dst, names_dump_type[ *dump_type ].strptr );
+        }
+      }
+      break;
+
+      case MESSENGER_DUMP_PCAP:
+      {
+        col_add_fstr( pinfo->cinfo, COL_INFO, "%s (%s)",
+                      src, names_dump_type[ *dump_type ].strptr );
+      }
+      break;
+
+      case MESSENGER_DUMP_LOGGER:
+      case MESSENGER_DUMP_SYSLOG:
+      case MESSENGER_DUMP_TEXT:
+      {
+        col_add_fstr( pinfo->cinfo, COL_INFO, "(%s)", names_dump_type[ *dump_type ].strptr );
+      }
+      break;
+      default:
+      break;
+    }
+  }
+
+  if ( trema_tree != NULL ) {
+    proto_tree *dump_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    offset = 0;
+
+    ti = proto_tree_add_item( trema_tree, hf_dump_header, tvb, offset, 18, FALSE );
+    dump_header_tree = proto_item_add_subtree( ti, ett_dump_header );
+
+    proto_tree_add_item( dump_header_tree, hf_dump_type, tvb, offset, 2, FALSE );
+    offset += 2;
+    nstime_t sent_time;
+    sent_time.secs = tvb_get_ntohl( tvb, offset );
+    sent_time.nsecs = tvb_get_ntohl( tvb, offset + 4 );
+    proto_tree_add_time( dump_header_tree, hf_dump_event_time, tvb, offset, 8, &sent_time );
+    offset += 8;
+    proto_tree_add_item( dump_header_tree, hf_dump_app_name_length, tvb, offset, 2, FALSE );
+    guint16 app_name_len = tvb_get_ntohs( tvb, offset );
+    offset += 2;
+    proto_tree_add_item( dump_header_tree, hf_dump_service_name_length, tvb, offset, 2, FALSE );
+    guint16 service_name_len = tvb_get_ntohs( tvb, offset );
+    offset += 2;
+    proto_tree_add_item( dump_header_tree, hf_dump_data_length, tvb, offset, 4, FALSE );
+    offset += 4;
+
+    if ( app_name_len > 0 ) {
+      proto_tree_add_item( trema_tree, hf_dump_app_name, tvb, offset, app_name_len, FALSE );
+      offset += app_name_len;
+    }
+    if ( service_name_len > 0 ) {
+      proto_tree_add_item( trema_tree, hf_dump_service_name, tvb, offset, service_name_len, FALSE );
+      offset += service_name_len;
+    }
+  }
+
+  return offset;
+}
+
+
+static gint
+dissect_openflow_service_header( tvbuff_t *tvb, gint offset, proto_tree *trema_tree ) {
+  gint head = offset;
+
+  guint16 service_name_len = tvb_get_ntohs( tvb, offset + 8 );
+
+  if ( trema_tree != NULL ) {
+    proto_tree *service_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_service_header, tvb, offset,
+                              sizeof( openflow_service_header_t ), FALSE );
+    service_header_tree = proto_item_add_subtree( ti, ett_service_header );
+
+    proto_tree_add_item( service_header_tree, hf_datapath_id, tvb, offset, 8, FALSE );
+    offset += 8;
+    proto_tree_add_item( service_header_tree, hf_service_name_length, tvb, offset, 2, FALSE );
+    offset += 2;
+    if ( service_name_len > 0 ) {
+      proto_tree_add_item( service_header_tree, hf_service_name, tvb, offset, service_name_len, FALSE );
+      offset += service_name_len;
+    }
+  }
+
+  return ( offset - head );  
+}
+
+
+static void
+dissect_openflow( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree ) {
+  if ( openflow_handle != NULL ) {
+    if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
+      col_append_str( pinfo->cinfo, COL_PROTOCOL, "+" );
+    }
+
+    if( check_col( pinfo->cinfo, COL_INFO ) ) {
+        col_append_str( pinfo->cinfo, COL_INFO, " => " );
+    }
+
+    col_set_fence( pinfo->cinfo, COL_PROTOCOL );
+    col_set_fence( pinfo->cinfo, COL_INFO );
+
+    call_dissector( openflow_handle, tvb, pinfo, trema_tree );
+  }
+  else {
+    // FIXME: do something here...
+  }
+}
+
+
+static gint
+dissect_context_handle( tvbuff_t *tvb, gint offset, proto_tree *trema_tree ) {
+  gint head = offset;
+
+  guint16 service_name_len = tvb_get_ntohs( tvb, offset + 4 );
+
+  if ( trema_tree != NULL ) {
+    proto_tree *context_handle_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_context_handle, tvb, offset,
+                              sizeof( messenger_context_handle ), FALSE );
+    context_handle_tree = proto_item_add_subtree( ti, ett_context_handle );
+
+    proto_tree_add_item( context_handle_tree, hf_transaction_id, tvb, offset, 4, FALSE );
+    offset += 4;
+    proto_tree_add_item( context_handle_tree, hf_service_name_length, tvb, offset, 2, FALSE );
+    offset += 2;
+    offset += 2; // padding
+    if ( service_name_len > 0 ) {
+      proto_tree_add_item( context_handle_tree, hf_service_name, tvb, offset, service_name_len, FALSE );
+      offset += service_name_len;
+    }
+  }
+
+  return ( offset - head );  
+}
+
+
+static gint
+dissect_message_dump( tvbuff_t *tvb, gint offset, proto_tree *trema_tree ) {
+  gint length = tvb_length_remaining( tvb, offset );
+
+  assert( tvb != NULL );
+  assert( trema_tree != NULL );
+
+  PRINTF( "dissect_message_dump()\n" );
+
+  if ( length > 0 ) {
+    proto_tree_add_item( trema_tree, hf_hex_dump, tvb, offset, length, FALSE );
+  }
+
+  return length;
+}
+
+
+static gint
+dissect_message_dump_with_length( tvbuff_t *tvb, gint offset, gint length, proto_tree *trema_tree ) {
+  gint remaining_length = tvb_length_remaining( tvb, offset );
+
+  assert( tvb != NULL );
+  assert( trema_tree != NULL );
+
+  PRINTF( "dissect_message_dump()\n" );
+
+  if ( remaining_length < length ) {
+    length = remaining_length;
+  }
+
+  proto_tree_add_item( trema_tree, hf_hex_dump, tvb, offset, length, FALSE );
+
+  return length;
+}
+
+
+static gint
+dissect_message_header( tvbuff_t *tvb, packet_info *pinfo, gint offset, proto_tree *trema_tree ) {
+  /*
+    typedef struct message_header {
+      uint8_t version;         // version = 0 (unused)
+      uint8_t message_type;    // MESSAGE_TYPE_
+      uint16_t tag;            // user defined
+      uint32_t message_length; // message length including header
+      uint8_t value[ 0 ];
+    } message_header;
+  */
+
+  gint head = offset;
+  guint8 message_type = tvb_get_guint8( tvb, offset + 1 );
+  guint16 tag = tvb_get_ntohs( tvb, offset + 2 );
+  guint32 message_length = tvb_get_ntohl( tvb, offset + 4 );
+
+  PRINTF( "dissect_message_header()\n" );
+
+  if ( trema_tree != NULL ) {
+    proto_tree *message_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_message_header, tvb, offset,
+                              sizeof( message_header ), FALSE );
+    message_header_tree = proto_item_add_subtree( ti, ett_message_header );
+
+    proto_tree_add_item( message_header_tree, hf_version, tvb, offset, 1, FALSE );
+    offset += 1;
+    proto_tree_add_item( message_header_tree, hf_message_type, tvb, offset, 1, FALSE );
+    offset += 1;
+    proto_tree_add_item( message_header_tree, hf_tag, tvb, offset, 2, FALSE );
+    offset += 2;
+    proto_tree_add_item( message_header_tree, hf_message_length, tvb, offset, 4, FALSE );
+    offset += 4;
+
+    if ( message_type == MESSAGE_TYPE_NOTIFY &&
+         tag >= MESSENGER_OPENFLOW_MESSAGE &&
+         tag <= MESSENGER_OPENFLOW_DISCONNECTED ) {
+      offset += dissect_openflow_service_header( tvb, offset, trema_tree );
+
+      if ( tag == MESSENGER_OPENFLOW_MESSAGE && openflow_handle != NULL ) {
+        guint16 total_len = tvb_reported_length_remaining( tvb, offset );
+        if ( total_len > 0 ) {
+          tvbuff_t *next_tvb = tvb_new_subset( tvb, offset, -1, total_len );
+          dissect_openflow( next_tvb, pinfo, trema_tree );
+        }
+        offset += total_len;
+      }
+    }
+    else if ( message_type == MESSAGE_TYPE_REQUEST ||
+              message_type == MESSAGE_TYPE_REPLY ) {
+      offset += dissect_context_handle( tvb, offset, trema_tree );
+    }
+
+    guint remaining_len = message_length - ( offset - head );
+    if ( remaining_len > 0 ) {
+      offset += dissect_message_dump_with_length( tvb, offset, remaining_len, trema_tree );
+    }
+  }
+
+  return ( offset - head );
+}
+
+
+static void
+dissect_trema_ipc( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *trema_tree,
+                   gint offset, gboolean visited, stream_id *stream_name ) {
+  gint remaining_length = 0;
+  tvbuff_t *messages_tvb;
+  tvbuff_t *next_tvb;
+
+  if ( visited ) {
+    packet_status_info *packet_status = NULL;
+    
+    PRINTF( " Known packet\n" );
+    // We have seen this packet
+    packet_status = get_packet_status( pinfo->fd->num );
+    assert( packet_status != NULL );
+    
+    if ( packet_status->reassemble_id != 0 ) {
+      // This is a part of fragment.
+      messages_tvb = get_reassembled_message( tvb, offset, pinfo, tree, stream_name );
+      if ( messages_tvb == NULL ) {
+        // We have not had all packets yet to reassemble this
+        dissect_message_dump( tvb, offset, trema_tree );
+        PRINTF( "----- end %u  (known packet)\n", pinfo->fd->num );
+        return;
+      }
+    }
+    else {
+      messages_tvb = tvb_new_subset( tvb, offset, -1, -1 );
+    }
+
+    offset = 0;
+    remaining_length = tvb_length_remaining( messages_tvb, offset );
+    while ( remaining_length > 0 ) {
+      next_tvb = trim_message( messages_tvb, offset );
+      if ( next_tvb == NULL ) {
+        dissect_message_dump( messages_tvb, offset, trema_tree );
+        break;
+      }
+      offset += tvb_length( next_tvb );
+      dissect_message_header( next_tvb, pinfo, 0, trema_tree );
+      remaining_length = tvb_length_remaining( messages_tvb, offset );
+    } // end of while
+
+    PRINTF( "----- end %u  (known packet, reassembled)\n", pinfo->fd->num );
+    return;
+  }
+
+  messages_tvb = tvb;
+  remaining_length = tvb_length_remaining( messages_tvb, offset );
+  PRINTF( " received payload length %d\n", remaining_length );
+  while ( remaining_length > 0 ) {
+    fragmented_stream_info *fragment_info = get_fragmented_stream_info( stream_name );
+    if ( fragment_info != NULL ) {
+      // this stream is in fragmentated status
+      PRINTF( " In fragmented status\n" );
+
+      dissect_message_dump( messages_tvb, offset, trema_tree );
+
+      messages_tvb = update_fragment_status( messages_tvb, offset, pinfo, tree, fragment_info, NULL );
+      if ( messages_tvb != NULL ) {
+        offset = 0;
+        remaining_length = tvb_length_remaining( messages_tvb, offset );
+      }
+
+      PRINTF( "  unreceived_len %d  remaining_len %d\n", fragment_info->unreceived_length, remaining_length );
+      if ( messages_tvb == NULL || fragment_info->unreceived_length > 0 ) {
+        // need more packet to reassemble
+        PRINTF( "----- end %u  need more packet to reassemble\n", pinfo->fd->num );
+        return;
+      }
+      else {
+        // reassembled message
+        PRINTF( "  reassembled message\n" );
+        next_tvb = trim_message( messages_tvb, offset );
+        assert( next_tvb != NULL );
+        offset += tvb_length( next_tvb );
+      }
+    }
+    else {
+      // Not in fragmented status
+      PRINTF( " Not in fragmented status\n" );
+
+      if ( remaining_length < sizeof( message_header ) ) {
+        // Not enough data received to get message length
+        PRINTF( "  Not enough data for message header  remaining_length %d\n", remaining_length );
+        dissect_message_dump( messages_tvb, offset, trema_tree );
+        messages_tvb = update_fragment_status( messages_tvb, offset, pinfo, tree, NULL, stream_name );
+        offset += remaining_length;
+        PRINTF( "----- end %u  (Not enough data for message header)\n", pinfo->fd->num );
+        return;
+      }
+      else {
+        guint32 message_length = tvb_get_ntohl( messages_tvb, offset + offsetof( message_header, message_length ) );
+        
+        if ( remaining_length < message_length ) {
+          // new fragment
+          dissect_message_dump( messages_tvb, offset, trema_tree );
+          messages_tvb = update_fragment_status( messages_tvb, offset, pinfo, tree, NULL, stream_name );
+          offset += remaining_length;
+          PRINTF( "----- end %u  (new fragment)\n", pinfo->fd->num );
+          return;
+        }
+        else {
+          next_tvb = trim_message( messages_tvb, offset );
+          assert( next_tvb != NULL );
+          offset += tvb_length( next_tvb );
+        }
+      }
+    }
+
+    dissect_message_header( next_tvb, pinfo, 0, trema_tree );
+
+    remaining_length = tvb_length_remaining( messages_tvb, offset );
+  } // end of while
+}
+
+
+static gint
+dissect_pcap_dump_header( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree, gint offset, guint32 *datalink ) {
+  /*
+    typedef struct pcap_dump_header {
+      uint32_t datalink;
+      uint8_t interface[ IF_NAMESIZE ];
+    } pcap_dump_header;
+  */
+  gint head = offset;
+
+  *datalink = tvb_get_ntohl( tvb, offset );
+
+  if ( trema_tree != NULL ) {
+    proto_tree *pcap_dump_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_pcap_dump_header, tvb, offset, sizeof( pcap_dump_header ), FALSE );
+    pcap_dump_header_tree = proto_item_add_subtree( ti, ett_pcap_dump_header );
+
+    proto_tree_add_item( pcap_dump_header_tree, hf_pcap_dump_datalink, tvb, offset, 4, FALSE );
+    offset += 4;
+    proto_tree_add_item( pcap_dump_header_tree, hf_pcap_dump_interface, tvb, offset, IF_NAMESIZE, FALSE );
+    offset += IF_NAMESIZE;
+  }
+
+  return ( offset - head );
+}
+
+
+static gint
+dissect_pcap_pkthdr( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree, gint offset ) {
+  /*
+    struct pcap_pkthdr {
+      struct timeval ts;
+      bpf_u_int32 caplen;
+      bpf_u_int32 len;
+    };
+  */
+  gint head = offset;
+
+  if ( trema_tree != NULL ) {
+    proto_tree *pcap_pkthdr_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_pcap_pkthdr, tvb, offset, sizeof( struct pcap_pkthdr ), FALSE );
+    pcap_pkthdr_tree = proto_item_add_subtree( ti, ett_pcap_pkthdr );
+
+    nstime_t ts;
+    ts.secs = tvb_get_ntohl( tvb, offset );
+    ts.nsecs = tvb_get_ntohl( tvb, offset + 4 ) * 1000;
+    proto_tree_add_time( pcap_pkthdr_tree, hf_pcap_pkthdr_ts, tvb, offset, sizeof( nstime_t ), &ts );
+    offset += sizeof( nstime_t );
+    proto_tree_add_item( pcap_pkthdr_tree, hf_pcap_pkthdr_caplen, tvb, offset, 4, FALSE );
+    offset += 4;
+    proto_tree_add_item( pcap_pkthdr_tree, hf_pcap_pkthdr_len, tvb, offset, 4, FALSE );
+    offset += 4;
+  }
+
+  return ( offset - head );
+}
+
+
+static void
+dissect_ethernet( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree ) {
+  if ( ethernet_handle != NULL ) {
+    if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
+      col_append_str( pinfo->cinfo, COL_PROTOCOL, "+" );
+    }
+
+    if( check_col( pinfo->cinfo, COL_INFO ) ) {
+        col_append_str( pinfo->cinfo, COL_INFO, " => " );
+    }
+
+    col_set_fence( pinfo->cinfo, COL_PROTOCOL );
+    col_set_fence( pinfo->cinfo, COL_INFO );
+
+    call_dissector( ethernet_handle, tvb, pinfo, trema_tree );
+  }
+  else {
+    // FIXME: do something here
+  }
+}
+
+
+static void
+dissect_pcap_dump( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *trema_tree,
+                   gint offset, gboolean visited, stream_id *stream_name ) {
+  guint32 datalink = 0;
+
+  offset += dissect_pcap_dump_header( tvb, pinfo, trema_tree, offset, &datalink );
+  offset += dissect_pcap_pkthdr( tvb, pinfo, trema_tree, offset );
+  if ( datalink == DLT_EN10MB ) {
+    guint16 remaining_len = tvb_reported_length_remaining( tvb, offset );
+    if ( remaining_len > 0 ) {
+      tvbuff_t *next_tvb = tvb_new_subset( tvb, offset, -1, remaining_len );
+      dissect_ethernet( next_tvb, pinfo, trema_tree );
+    }
+    offset += remaining_len;
+  }
+  dissect_message_dump( tvb, offset, trema_tree );
+}
+
+
+static gint
+dissect_syslog_dump_header( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree, gint offset ) {
+  /*
+    typedef struct syslog_dump_header {
+      struct {
+        uint32_t sec;
+        uint32_t nsec;
+      } sent_time;
+    } syslog_dump_header;
+  */
+  gint head = offset;
+
+  if ( trema_tree != NULL ) {
+    proto_tree *syslog_dump_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_syslog_dump_header, tvb, offset, sizeof( syslog_dump_header ), FALSE );
+    syslog_dump_header_tree = proto_item_add_subtree( ti, ett_syslog_dump_header );
+
+    nstime_t receive_time;
+    receive_time.secs = tvb_get_ntohl( tvb, offset );
+    receive_time.nsecs = tvb_get_ntohl( tvb, offset + 4 );
+    proto_tree_add_time( syslog_dump_header_tree, hf_syslog_dump_receive_time, tvb, offset, 8, &receive_time );
+    offset += sizeof( syslog_dump_header );
+  }
+
+  return ( offset - head );
+}
+
+
+static void
+dissect_syslog( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree ) {
+  if ( udp_dissector_table != NULL ) {
+    if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
+      col_append_str( pinfo->cinfo, COL_PROTOCOL, "+" );
+    }
+
+    if( check_col( pinfo->cinfo, COL_INFO ) ) {
+        col_append_str( pinfo->cinfo, COL_INFO, " => " );
+    }
+
+    col_set_fence( pinfo->cinfo, COL_PROTOCOL );
+    col_set_fence( pinfo->cinfo, COL_INFO );
+
+    dissector_try_port( udp_dissector_table, UDP_PORT_SYSLOG, tvb, pinfo, trema_tree );
+  }
+  else {
+    gint length = tvb_length_remaining( tvb, 0 );
+    if ( length > 0 ) {
+      proto_tree_add_item( trema_tree, hf_syslog_dump_message, tvb, 0, length, FALSE );
+    }
+  }
+}
+
+
+static void
+dissect_syslog_dump( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *trema_tree,
+                     gint offset, gboolean visited, stream_id *stream_name ) {
+
+  offset += dissect_syslog_dump_header( tvb, pinfo, trema_tree, offset );
+  guint16 remaining_len = tvb_reported_length_remaining( tvb, offset );
+  if ( remaining_len > 0 ) {
+    tvbuff_t *next_tvb = tvb_new_subset( tvb, offset, -1, remaining_len );
+    dissect_syslog( next_tvb, pinfo, trema_tree );
+  }
+}
+
+
+static gint
+dissect_text_dump_header( tvbuff_t *tvb, packet_info *pinfo, proto_tree *trema_tree, gint offset ) {
+  /*
+    typedef struct text_dump_header {
+      struct {
+        uint32_t sec;
+        uint32_t nsec;
+      } sent_time;
+    } text_dump_header;
+  */
+  gint head = offset;
+
+  if ( trema_tree != NULL ) {
+    proto_tree *text_dump_header_tree = NULL;
+    proto_item *ti = NULL;
+
+    ti = proto_tree_add_item( trema_tree, hf_text_dump_header, tvb, offset, sizeof( text_dump_header ), FALSE );
+    text_dump_header_tree = proto_item_add_subtree( ti, ett_text_dump_header );
+
+    nstime_t receive_time;
+    receive_time.secs = tvb_get_ntohl( tvb, offset );
+    receive_time.nsecs = tvb_get_ntohl( tvb, offset + 4 );
+    proto_tree_add_time( text_dump_header_tree, hf_text_dump_receive_time, tvb, offset, 8, &receive_time );
+    offset += sizeof( text_dump_header );
+  }
+
+  return ( offset - head );
+}
+
+
+static void
+dissect_text_dump( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *trema_tree,
+                   gint offset, gboolean visited, stream_id *stream_name ) {
+
+  offset += dissect_text_dump_header( tvb, pinfo, trema_tree, offset );
+  guint16 remaining_len = tvb_reported_length_remaining( tvb, offset );
+  if ( remaining_len > 0 ) {
+    proto_tree_add_item( trema_tree, hf_text_dump_string, tvb, offset, -1, FALSE );
+
+    gchar *string = tvb_format_text( tvb, offset, remaining_len - 1 );
+
+    if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
+      col_append_str( pinfo->cinfo, COL_PROTOCOL, "+TEXT" );
+    }
+
+    if( check_col( pinfo->cinfo, COL_INFO ) && string != NULL ) {
+      col_append_str( pinfo->cinfo, COL_INFO, " => " );
+      col_append_str( pinfo->cinfo, COL_INFO, string );
+    }
+
+    col_set_fence( pinfo->cinfo, COL_PROTOCOL );
+    col_set_fence( pinfo->cinfo, COL_INFO );
+  }
+}
+
+
+static void
+dissect_trema( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) {
+  gboolean visited = TRUE;
+  gint offset = 0;
+  guint16 dump_type = 0;
+  proto_tree *trema_tree = NULL;
+  proto_item *ti = NULL;
+  stream_id stream_name;
+
+  PRINTF( "----- start %u\n", pinfo->fd->num );
+  
+  if ( tree == NULL ) {   // FIXME: is it okay to return here?
+    PRINTF( "----- end %u  (tree is NULL)\n", pinfo->fd->num );
+    return;
+  }
+
+  if ( check_packet_status( pinfo->fd->num ) == FALSE ) {
+    visited = FALSE;
+    update_packet_status( pinfo->fd->num, 0 );
+  }
+
+  if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
+    col_set_str( pinfo->cinfo, COL_PROTOCOL, PROTO_TAG_TREMA );
+  }
+
+  ti = proto_tree_add_item( tree, proto_trema, tvb, 0, -1, FALSE );
+  trema_tree = proto_item_add_subtree( ti, ett_trema );
+
+  get_stream_id( tvb, &stream_name );
+  PRINTF( " app [%s]  service [%s]\n", stream_name.app_name, stream_name.service_name );
+
+  offset = dissect_message_pcap_dump_header( tvb, pinfo, trema_tree, &dump_type );
+  if ( tvb_length_remaining( tvb, offset ) <= 0 ) {
+    PRINTF( "----- end %u  (message_pcap_dump_header only)\n", pinfo->fd->num );
+    return;
+  }
+
+  if ( dump_type >= MESSENGER_DUMP_SENT && dump_type <= MESSENGER_DUMP_SEND_CLOSED ) {
+    dissect_trema_ipc( tvb, pinfo, tree, trema_tree, offset, visited, &stream_name );
+  }
+  else if ( dump_type == MESSENGER_DUMP_PCAP ) {
+    dissect_pcap_dump( tvb, pinfo, tree, trema_tree, offset, visited, &stream_name );
+  }
+  else if ( dump_type == MESSENGER_DUMP_SYSLOG ) {
+    dissect_syslog_dump( tvb, pinfo, tree, trema_tree, offset, visited, &stream_name );
+  }
+  else if ( dump_type == MESSENGER_DUMP_TEXT ) {
+    dissect_text_dump( tvb, pinfo, tree, trema_tree, offset, visited, &stream_name );
+  }
+  else {
+    // FIXME
+    dissect_message_dump( tvb, offset, trema_tree );
+  }
+
+  PRINTF( "----- end %u\n", pinfo->fd->num );
+}
+
+
+void
+proto_register_trema() {
+  static hf_register_info hf[] = {
+    { &hf_dump_header,
+      { "Dump header", "trema.dump_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Dump header", HFILL }},
+    { &hf_dump_type,
+      { "Type", "trema.dump_type",
+        FT_UINT16, BASE_DEC, VALS( names_dump_type ), NO_MASK, "Type", HFILL }},
+    { &hf_dump_event_time,
+      { "Event occurred at", "trema.dump_event_time",
+        FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NO_STRINGS, NO_MASK, "Event Occurred at", HFILL }},
+    { &hf_dump_app_name_length,
+      { "Application name length", "trema.dump_app_name_length",
+        FT_UINT16, BASE_DEC, NO_STRINGS, NO_MASK, "Application name length", HFILL }},
+    { &hf_dump_service_name_length,
+      { "Service name length", "trema.dump_service_name_length",
+        FT_UINT16, BASE_DEC, NO_STRINGS, NO_MASK, "Service name length", HFILL }},
+    { &hf_dump_data_length,
+      { "Data length", "trema.dump_data_length",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, "Data length", HFILL }},
+    { &hf_dump_app_name,
+      { "Application name", "trema.dump_app_name",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Application name", HFILL }},
+    { &hf_dump_service_name,
+      { "Service name", "trema.dump_service_name",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Service name", HFILL }},
+    { &hf_message_header,
+      { "Message header", "trema.message_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Mesasge header", HFILL }},
+    { &hf_version,
+      { "Version", "trema.version",
+        FT_UINT8, BASE_DEC, NO_STRINGS, NO_MASK, "Version", HFILL }},
+    { &hf_message_type,
+      { "Type", "trema.type",
+        FT_UINT8, BASE_DEC, VALS( names_message_type ), NO_MASK, "Type", HFILL }},
+    { &hf_tag,
+      { "Tag", "trema.tag",
+        FT_UINT16, BASE_DEC, VALS( names_service_tag ), NO_MASK, "Tag", HFILL }},
+    { &hf_message_length,
+      { "Length", "trema.length",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, "Length", HFILL }},
+    { &hf_service_header,
+      { "OpenFlow service header", "trema.service_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "OpenFlow service header", HFILL }},
+    { &hf_datapath_id,
+      { "Datapath ID", "trema.datapath_id",
+        FT_UINT64, BASE_HEX, NO_STRINGS, NO_MASK, "Datapath ID", HFILL }},
+    { &hf_service_name_length,
+      { "Service name length", "trema.service_name_length",
+        FT_UINT16, BASE_DEC, NO_STRINGS, NO_MASK, "Service name length", HFILL }},
+    { &hf_service_name,
+      { "Service name", "trema.service_name",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Service name", HFILL }},
+    { &hf_context_handle,
+      { "Request/Reply context handle", "trema.context_handle",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Request/Reply context handle", HFILL }},
+    { &hf_transaction_id,
+      { "Transaction ID", "trema.transaction_id",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, "Transaction ID", HFILL }},
+    { &hf_hex_dump,
+      { "[Unknown data]", "trema.hex_dump",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Hex dump", HFILL }},
+
+    // pcap_dump_header
+    { &hf_pcap_dump_header,
+      { "PCAP dump header", "trema.pcap_dump_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "PCAP dump header", HFILL }},
+    { &hf_pcap_dump_datalink,
+      { "Datalink", "trema.pcap_dump_datalink",
+        FT_UINT32, BASE_DEC, VALS( names_datalink_type ), NO_MASK, "Datalink", HFILL }},
+    { &hf_pcap_dump_interface,
+      { "Interface", "trema.pcap_dump_interface",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Inerface", HFILL }},
+
+    // pcap_pkthdr
+    { &hf_pcap_pkthdr,
+      { "PCAP packet header", "trema.pcap_pkthdr",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "PCAP packet header", HFILL }},
+    { &hf_pcap_pkthdr_ts,
+      { "Captured at", "trema.pcap_pkthdr_ts",
+        FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NO_STRINGS, NO_MASK, "Captured at", HFILL }},
+    { &hf_pcap_pkthdr_caplen,
+      { "Capture length", "trema.pcap_pkthdr_caplen",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, "Capture length", HFILL }},
+    { &hf_pcap_pkthdr_len,
+      { "Frame length", "trema.pcap_pkthdr_len",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, "Frame length", HFILL }},
+
+    // syslog_dump_header
+    { &hf_syslog_dump_header,
+      { "Syslog dump header", "trema.syslog_dump_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Syslog dump header", HFILL }},
+    { &hf_syslog_dump_receive_time,
+      { "Received at", "trema.syslog_dump_receive_time",
+        FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NO_STRINGS, NO_MASK, "Received at", HFILL }},
+
+    // text_dump_header
+    { &hf_text_dump_header,
+      { "Text dump header", "trema.text_dump_header",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, "Text dump header", HFILL }},
+    { &hf_text_dump_receive_time,
+      { "Received at", "trema.text_dump_receive_time",
+        FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NO_STRINGS, NO_MASK, "Received at", HFILL }},
+    { &hf_text_dump_string,
+      { "Text string", "trema.text_dump_string",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Text string", HFILL }},
+
+    // raw syslog message
+    { &hf_syslog_dump_message,
+      { "Raw syslog message", "trema.syslog_message",
+        FT_STRING, BASE_NONE, NO_STRINGS, NO_MASK, "Raw syslog message", HFILL }},
+
+    // Fragment fields
+    { &hf_trema_fragments,
+      { "Trema fragments", "trema.fragments",
+        FT_NONE, BASE_NONE, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment,
+      { "Trema fragment", "trema.fragment",
+        FT_FRAMENUM, BASE_NONE, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment_overlap,
+      { "Trema fragment overlap", "trema.fragment.overlap",
+        FT_BOOLEAN, 0, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment_overlap_conflict,
+      { "Trema fragment overlapping with conflicting data", "trema.fragment.overlap.conflicts",
+        FT_BOOLEAN, 0, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment_multiple_tails,
+      { "Trema has multiple tail fragments", "trema.fragment.multiple_tails",
+        FT_BOOLEAN, 0, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment_too_long_fragment,
+      { "Trema fragment too long", "trema.fragment.too_long_fragment",
+        FT_BOOLEAN, 0, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_fragment_error,
+      { "Trema defragmentation error", "trema.fragment.error",
+        FT_FRAMENUM, BASE_NONE, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_reassembled_in,
+      { "Reassembled in", "trema.reassembled.in",
+        FT_FRAMENUM, BASE_NONE, NO_STRINGS, NO_MASK, NULL, HFILL }},
+    { &hf_trema_reassembled_length,
+      { "Reassembled length", "trema.reassembled.length",
+        FT_UINT32, BASE_DEC, NO_STRINGS, NO_MASK, NULL, HFILL }},
+  };
+
+  static gint *ett[] = {
+    &ett_trema,
+    &ett_dump_header,
+    &ett_message_header,
+    &ett_service_header,
+    &ett_context_handle,
+    &ett_trema_fragment,
+    &ett_trema_fragments,
+    &ett_pcap_dump_header,
+    &ett_pcap_pkthdr,
+    &ett_syslog_dump_header,
+    &ett_text_dump_header,
+  };
+
+  proto_trema = proto_register_protocol( "Trema Universal Event Dumper", "TREMA", "trema" );
+  proto_register_field_array( proto_trema, hf, array_length( hf ) );
+  proto_register_subtree_array( ett, array_length( ett ) );
+  register_dissector( "trema", dissect_trema, proto_trema );
+
+  register_init_routine( init_trema_fragment );
+}
+
+
+void
+proto_reg_handoff_trema() {
+  ethernet_handle = find_dissector( "eth" );
+  ppp_handle = find_dissector( "ppp" );
+  ip_handle = find_dissector( "ip" );
+  openflow_handle = find_dissector( "openflow" );
+  sll_dissector_table = find_dissector_table( "sll.ltype" );
+  udp_dissector_table = find_dissector_table( "udp.port" );
+}
+
+
+/*
+ * Local variables:
+ * c-basic-offset: 2
+ * indent-tabs-mode: nil
+ * End:
+ */