Wireshark · Ethereal-dev: Re: [Ethereal-dev] [Patch] tethereal -z tcp,close

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Nov 27, 2002 at 04:20:34PM +1100, Ronnie Sahlberg wrote:
> I think, for example for a "tcp" tap, it may be appropriate to have this
> return a pointer to a structure holding the tcp header (minus options fields
> maybe).
> This may also require the tcp dissector to be recoded slightly to actually
> use
> this tcp_header_struct instead of accessing the fields directly using
> tvb_get_xxx or
> by using separate variables holding it.

The reason why it individually fetches the fields using "tvb_get_xxx" is
that if the packet is short, you get at least *some* of the fields put
into the protocol tree before it throws a BoundsException, rather than
getting nothing unless the entire header is available in the tvbuff:

  % cvs log packet-tcp.c

	...

  revision 1.111
  date: 2001/10/01 08:29:35;  author: guy;  state: Exp;  lines: +133 -109

	...

  Don't dissect the TCP header by grabbing the entire header with
  "tvb_memcpy()" and then pulling stuff out of it - extract stuff with
  individual tvbuff calls, and put stuff into the protocol tree and the
  Info column as we extract it, so that we can dissect a partial header.
  This lets us, for example, get the source and destination ports from the
  TCP header of the part of a TCP segment included in a minimum-length
  ICMPv4 error packet.

	...

As such, the TCP dissector should continue to access the fields directly
using the "tvb_get_xxx" routines; however, instead of having separate
variables for the fields, we could have a structure with members for
those variables, fill in those members by fetching values with the
"tvb_get_xxx" routines, and then use that structure for the tap.