Wireshark · Wireshark-dev: Re: [Wireshark-dev] dissector_add(tcp.proto... / where to find parameter for dissector_add()

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 24, 2009, at 8:31 AM, Armin Zimmermann wrote:

> The reason I want to know this is that tvb_reported_length() gives  
> me the length of the data without the TCP-Header but in case of an  
> UDP package it gives me the length of the data included the UDP  
> Header.

Not if you have a heuristics UDP dissector, it doesn't.  Heuristic UDP  
dissectors - i.e., dissectors registered with  
heur_dissector_add("udp", dissect_XXX, proto_XXX) - get passed a   
tvbuff containing the UDP *payload*, not including the header, so  
tvb_reported_length() will not include the size of the UDP header.

The same is true for heuristic TCP dissectors - you get a tvbuff  
containing the TCP segment's contents, not including the TCP header.