Ethereal-dev: Re: [Ethereal-dev] Pcap file Cleaning

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Mon, 21 Jan 2002 10:39:12 -0600
On Mon, 21 Jan 2002 09:19:39 Nathan Neulinger wrote:
> Is any tree field added to the frame for 'malformed packet' failures?
> i.e. if there isn't, might be worthwhile to do so, so you can easily
> select/view/etc. any packet that shows up as invalid/corrupt/etc. 
> 

Yes, "short", "malformed" and "unreassembled" are all "protocols"
that are added to the proto_tree as appropriate. See packet-frame.c
for details.

There's another case in epan/packet.c (dissect_packet) where
a packet can also be malformed... if the creation of the initial
tvbuff fails due to insufficient data (i.e., the captured-length
reported in the file is not correct), probably due to a truncated
file. In that case, too, the "malformed" protocol is added to
the proto_tree.

--gilbert