Wireshark-dev: Re: [Wireshark-dev] Hierarchy of fields & offsets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 25 Jul 2017 15:45:06 -0700
On Jul 25, 2017, at 3:26 PM, Sultan, Hassan via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:

> Any reason why this is done in this way?

I don't know, but, whatever it is, it's not a *good* reason.

Perhaps they didn't know how to handle a request whose length isn't known until you finish dissecting it.  The answer is "give it an initial length of -1, to cover the rest of the data, and then set the length at the end"; I've changed the MySQL dissector in the master and 2.4 branches to do that.