Ethereal-users: Re: visualizing packet (tcp)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: guy@xxxxxxxxxx (Guy Harris)
Date: Mon, 12 Oct 1998 23:09:34 -0700 (PDT)
> it's seems like ten or twelve char is missing form data section,

Laurent Deniel noted, on the "ethereal-dev" list, that the extra bytes
at the end of the frame are the TCP Maximum Segment Size option; the
frame is the initial SYN for the TCP connection, and has no data.

The released versions of Ethereal won't decode IP or TCP options, but
code was recently checked in to decode them, and that code correctly
decoded that option, so some future release should handle that.