Wireshark mailing list archives
Re: catching [Malformed Packet]
From: Guy Harris <guy () alum mit edu>
Date: Sat, 24 Sep 2011 12:09:12 -0700
On Sep 24, 2011, at 9:58 AM, Chris Maynard wrote:
Roland Knall <rknall@...> writes:On a similar topic, how can you mark a package as malformed? Especially generated packages often fail the openSAFETY dissector, and marking them as malformed seems to make sense in such cases.Many dissectors make use of the expert infos for this.
...which is the right way to do it. Doing it by throwing an exception makes errors such as "malformed because field XXX is too short" indistinguishable from "malformed because the packet is missing data at the end", and also means you stop dissecting at that point. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- catching [Malformed Packet] mmann78 (Sep 24)
- Re: catching [Malformed Packet] Chris Maynard (Sep 24)
- Re: catching [Malformed Packet] Roland Knall (Sep 24)
- Re: catching [Malformed Packet] Chris Maynard (Sep 24)
- Re: catching [Malformed Packet] Guy Harris (Sep 24)
- Re: catching [Malformed Packet] Roland Knall (Sep 24)
- Re: catching [Malformed Packet] Martin Mathieson (Sep 24)
- Re: catching [Malformed Packet] Roland Knall (Sep 24)
- Re: catching [Malformed Packet] Chris Maynard (Sep 24)