Wireshark-dev: Re: [Wireshark-dev] Packet not reaching dissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Sat, 08 May 2010 10:05:14 -0400
Craig Bumpstead wrote:

Hi,

I've noticed that Frame 2 with the bad header checksum reaches my dissector
but Frame 3 with a LEN=0 doesn't actually reach my dissector (Stepping
though the code with VS 2008). Is this normal for WireShark??

Note: I have censored the IP's and MAC addresses.



If there's no TCP payload (eg: the packet is just a TCP ack)
then there's nothing to dissect beyond TCP.

Frame 2 has 6 bytes of TCP payload so your dissector is called.

Frame 3 has 0 bytes of TCP payload.

Is that the question ?