[Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>]

On Mon, 21 Jan 2002 09:19:39 Nathan Neulinger wrote:
> Is any tree field added to the frame for 'malformed packet' failures?
> i.e. if there isn't, might be worthwhile to do so, so you can easily
> select/view/etc. any packet that shows up as invalid/corrupt/etc. 
> 

Yes, "short", "malformed" and "unreassembled" are all "protocols"
that are added to the proto_tree as appropriate. See packet-frame.c
for details.

There's another case in epan/packet.c (dissect_packet) where
a packet can also be malformed... if the creation of the initial
tvbuff fails due to insufficient data (i.e., the captured-length
reported in the file is not correct), probably due to a truncated
file. In that case, too, the "malformed" protocol is added to
the proto_tree.

--gilbert