Ethereal-dev: Re: [Ethereal-dev] Length/reported length
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Jasim Tariq wrote:
Can anyone tell me what is the difference between "reported length" and
"length" of the tvbuff_t. An example would really help in this case.
The "reported length" is the amount of data that was received (or sent)
by the machine running Ethereal. The "length" is the amount of that
data that the packet capture mechanism in the OS supplied; that can be
less than the reported length, because you could have captured with a
"snapshot length" or "packet slicing" or whatever the packet capture
program used calls it.
Consider, for example, a capture of a 1024-byte Ethernet packet with a
version of tcpdump built with IPv6 support and without the "-s" flag
used to explicitly set the snapshot length. That means that the default
tcpdump snapshot length of 96 bytes will be used.
The Ethernet dissector will be handed a tvbuff with a "reported length"
of 1024, meaning the packet was 1024 bytes long, and a "length" of 96,
meaning that only 96 bytes of that data are present. The "length" just
means how much data is available; it should *NOT* be used as the length
of the packet, because the packet was, as indicated, 1024 bytes long.
