Wireshark · Ethereal-dev: Re: [ethereal-dev] A patch to reveal packet PADD-ing bytes

[Guy Harris <gharris@xxxxxxxxxxxx>]

> It is important to see the padded area because in this way you could
> troubleshoot more easily the dissectors (among other things).
> This implies that every dissector should make a call in the end to
> dissect_data(...) routine.

...or provide a "dissect_padding()" routine, and have them all call
that.

I'm somewhat inclined to see if that could be done in the Ethernet
dissector, though, as

	1) the padding data could perhaps be thought of as "belonging"
	   to the Ethernet layer

and

	2) that would obviate the need to modify all dissectors.

However, not all layers above Ethernet necessarily have a simple length
field that's used to update "pi.len" or "pi.captured_len", as far as I
know, so that might require the dissectors to update that field
themselves, or otherwise indicate how much they've dissected.  At least
protocols that are only called from layers that do have such a length
field, e.g. all dissectors for protocols that ultimately run only under
IP, might not have to be modified in that fashion.

The Ethernet padding is, as I remember, to ensure that a packet takes
enough time to transmit that, by the time the last byte of the packet is
put on the wire, the first byte of the packet has reached both ends of
the wire, and thus to ensure that a collision will occur if anybody
starts transmitting at any point during the transmission of the packet;
I think most other link layers don't need that, and thus don't pad their
packets, but we could add padding to those if necessary.