Ethereal-dev: Re: [Ethereal-dev] RFC: new TVBUFF type

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 23 May 2001 13:07:25 -0700
On Wed, May 23, 2001 at 09:35:01AM +0200, andreas.sikkema@xxxxxxxxxxx wrote:
> I think all ASN.1 based protocols will be almost impossible to 
> dissect if there are holes. 

Are they impossible to dissect *at all* if the capture was done with a
short snapshot length?  Are they impossible to dissect if the
higher-level packet is not reassembled, so you only look at one frame's
worth of data?

They can't be dissected in their entirety, as there's missing data - but
you can at least start at the beginning and keep dissecting until you
run out of data (as demonstrated by the fact that we're doing exactly
that right now, for short frames and un-reassembled data).

The only difference a hole in the middle of the packet would make would
be that we'd probably stop at a point that has data somewhere after it -
just not *immediately* after it.