Re: Malformed Packet

[Martin Mathieson <martin.r.mathieson () googlemail com>]

On Fri, Jan 11, 2013 at 7:11 PM, Guy Harris <guy () alum mit edu> wrote:

> On Jan 11, 2013, at 5:17 AM, "Ewgenij Sokolovski" <ewgenijkkg () gmx de>
> wrote:
>
> > Maybe it would be a good idea to change the error output? "Malformed
> Packet" is too general and misleading sometimes.
>
> "Malformed packet" is used in some other cases as well.  Either we should
> stop putting "Malformed packet" into the protocol tree at all, and put the
> real error as the main message rather than the secondary message, or we
> should, at least, improve the secondary message(s).  In this particular
> case, perhaps "packet is too short" is better than the geeky "exception
> occurred".
>
> > For example, not the packet could be malformed but the dissector could
> be buggy :)
>
> That could be the case for *any* case where the packet dissection claims
> there's something wrong with the packet.
I like having malformed in the protocol tree, or at least I like to be able
to use the 'malformed' filter.
Note that it is also added hidden when malformed is used as a type of
expert info.

Martin

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe