Wireshark · Wireshark-dev: Re: [Wireshark-dev] tvb_captured_length or tvb_reported_length?

[Evan Huus <eapache@xxxxxxxxx>]

Many systems support packet capture such that only the first n bytes
of each captured packet is saved, as this is far more efficient and
frequently enough if you're only interested in the headers. When that
occurs, "captured" is the number of bytes actually captured, while
"reported" is the original number of bytes on the wire.

The vast majority of the time, dissectors need to use the length
reported on the wire; the captured length is only useful in specific
circumstances like reassembling fragmented messages.

Evan

On Wed, Sep 2, 2015 at 1:33 PM, Robert Cragie
<robert.cragie@xxxxxxxxxxxxx> wrote:
> I am trying to understand the changes to the previous use of tvb_length().
> There are now two functions (and their associates):
>
> * tvb_captured_length()
> * tvb_reported_length()
>
> As far as I can tell, tvb_captured_length() is the direct replacement for
> tvb_length() but tvbuff.h says "You probably want tvb_reported_length
> instead.". The use of both seems to be mixed throughout the files and it's
> difficult to follow the relationship between the two. So any guidance on
> this would be appreciated.
>
> Thanks
>
> Robert
>
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe