Wireshark mailing list archives

Re: Is "tcp.len < -1" a valid display filter?

From: Stephen Fisher <steve () stephen-fisher com>
Date: Thu, 27 Oct 2011 13:12:22 -0600

On Thu, Oct 27, 2011 at 08:28:43AM +0200, Stig Bjørlykke wrote:

On a 32-bit system the display filter "tcp.len < -1" seems to be 
valid, and does return all TCP packets.

The attached patch fixes this, but can we do this check in a simpler 
manner?


Is there a problem with accepting -1 in that filter?  If so, should the 
filter be checked against possible values of the value, i.e. tcp.len is 
a FT_UINT32 so only accept unsigned 32-bit values and mark the 
background as red / bad filter if not?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread:

Is "tcp.len < -1" a valid display filter? Stig Bjørlykke (Oct 26)
- Re: Is "tcp.len < -1" a valid display filter? Stephen Fisher (Oct 27)
  - Re: Is "tcp.len < -1" a valid display filter? Stig Bjørlykke (Oct 28)
    - Re: Is "tcp.len < -1" a valid display filter? Stephen Fisher (Oct 28)
    - Re: Is "tcp.len < -1" a valid display filter? Stig Bjørlykke (Oct 28)
    - Re: Is "tcp.len < -1" a valid display filter? Guy Harris (Oct 28)