Re: tvb_captured_length or tvb_reported_length?

[Pascal Quantin <pascal.quantin () gmail com>]

2015-09-02 19:37 GMT+02:00 Evan Huus <eapache () gmail com>:

> Many systems support packet capture such that only the first n bytes
> of each captured packet is saved, as this is far more efficient and
> frequently enough if you're only interested in the headers. When that
> occurs, "captured" is the number of bytes actually captured, while
> "reported" is the original number of bytes on the wire.
>
> The vast majority of the time, dissectors need to use the length
> reported on the wire; the captured length is only useful in specific
> circumstances like reassembling fragmented messages.
>
> Evan

Evan was faster than me ;) Interestingly we did not think to the same use
case for captured length usage, which shows why I said it deserves careful
thinking.

Pascal.


> On Wed, Sep 2, 2015 at 1:33 PM, Robert Cragie
> <robert.cragie () gridmerge com> wrote:
> > I am trying to understand the changes to the previous use of
> tvb_length().
> > There are now two functions (and their associates):
> >
> > * tvb_captured_length()
> > * tvb_reported_length()
> >
> > As far as I can tell, tvb_captured_length() is the direct replacement for
> > tvb_length() but tvbuff.h says "You probably want tvb_reported_length
> > instead.". The use of both seems to be mixed throughout the files and
> it's
> > difficult to follow the relationship between the two. So any guidance on
> > this would be appreciated.
> >
> > Thanks
> >
> > Robert
> ___________________________________________________________________________
> > Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> > Archives:    https://www.wireshark.org/lists/wireshark-dev
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> >              mailto:wireshark-dev-request () wireshark org
> ?subject=unsubscribe
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe