Wireshark-dev: Re: [Wireshark-dev] Informing user of incomplete dissection
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "d3c1978@xxxxxxxxx" <d3c1978@xxxxxxxxx>
Date: Sat, 5 Mar 2016 01:07:02 +0000 (UTC)
How about grouping them as an 'Unknown Extension'?




On Fri, Mar 4, 2016 at 7:55 PM, Mike Morrin
<morrinmike@xxxxxxxxx> wrote:
I have a dissector which does not yet dissect all of the possible information elements of a protocol.

What should the dissector do when it recognises that an IE cannot be handled?
  • Ignoring the un-dissected octets leaves the user with a false sense of believing the dissection was complete
  • DISSECTOR_ASSERT is much too invasive.
  • Expert info, would seem to be the best option, but I recall that it was intended to be used for providing information about the captured packets, rather than about dissector deficiencies.
What is the generally accepted solution?

This email has been sent from a virus-free computer protected by Avast.
www.avast.com
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe